Network supporting two-factor authentication for modules with embedded universal integrated circuit cards

ABSTRACT

A network with a set of servers can support authentication from a module, where the module includes an embedded universal integrated circuit card (eUICC). The network can send a first network module identity, a first key K, and an encrypted second key K for an eUICC profile to an eUICC subscription manager. The second key K can be encrypted with a symmetric key. The module can receive and activate the eUICC profile, and the network can authenticate the module using the first network module identity and the first key K. The network can (i) authenticate the user of the module using a second factor, and then (ii) send the symmetric key to the module. The module can decrypt the encrypted second key K using the symmetric key. The network can authenticate the module using the second key K. The module can comprise a mobile phone.

CROSS-REFERENCE TO RELATED APPLICATIONS

This is a continuation of U.S. patent application Ser. No. 15/162,292filed May 23, 2016, which is a continuation of U.S. patent applicationSer. No. 14/139,419 filed Dec. 23, 2013, which application is fullyincorporated by reference herein.

The subject matter of this application is related to the subject matterof U.S. patent application Ser. No. 14/084,141, filed Nov. 19, 2013 inthe name of John Nix, entitled “Key Derivation for a Module using anEmbedded Universal Integrated Circuit Card,” which is herebyincorporated by reference in its entirety.

The subject matter of this application is also related to the subjectmatter of U.S. patent application Ser. No. 14/099,329, filed Dec. 6,2013 in the name of John Nix, entitled “An Embedded Universal IntegratedCircuit Card Supporting Two-Factor Authentication,” which is herebyincorporated by reference in its entirety.

BACKGROUND Technical Field

The present methods and systems relate to communications for a network,and more particularly, to methods and systems for a network to use anembedded universal integrated circuit card (eUICC), where the methodsand systems also support the authentication of a user associated withthe eUICC.

Description of Related Art

The combination of “machine-to-machine” (M2M) communications and usinglow-cost sensors, Internet connections, and processors is a promisingand growing field. Among many potential benefits, M2M technologies allowthe remote monitoring and/or control of people, assets, or a locationwhere manual monitoring is not economic, or costs can be significantlyreduced by using automated monitoring as opposed to manual techniques.Prominent examples today include vending machines, automobiles, alarmsystems, and remote sensors. Fast growing markets for M2M applicationstoday include tracking devices for shipping containers or pallets,health applications such as, but not limited to, the remote monitoringof a person's glucose levels or heartbeat, monitoring of industrialequipment deployed in the field, and security systems. Many M2Mapplications leverage either wired Internet connections or wirelessconnections, and both types of connections continue to grow rapidly. M2Mapplications may also be referred to as “the Internet of things”.

M2M communications can provide remote control over actuators that may beconnected to a M2M device, such as, but not limited to, turning on oroff a power switch, locking or unlocking a door, adjusting a speed of amotor, or similar remote control. A decision to change or adjust anactuator associated with an M2M device can utilize one or a series ofsensor measurements. An M2M device may also be referred to as a“wireless module” or also simply a module. As one example, if a buildingor room is too cold, then temperature can be reported to a centralserver by an M2M device and the server can instruct the M2M device toturn on a switch that activates heat or adjusts a thermostat. As thecosts for computer and networking hardware continue to decline, togetherwith the growing ease of obtaining either wired or wireless Internetaccess for small form-factor devices, the number of economicallyfavorable applications for M2M communications grows.

Many M2M applications can leverage wireless networking technologies.Wireless technologies such as, but not limited to, wireless local areanetworks and wireless wide area networks have proliferated around theworld over the past 15 years, and usage of these wireless networks isalso expected to continue to grow. Wireless local area network (LAN)technologies include WiFi and wireless wide area network (WAN)technologies include 3^(rd) Generation Partnership Project's (3GPP)3^(rd) Generation (3G) Universal Mobile Telecommunications System (UMTS)and 4^(th) Generation (4G) Long-term Evolution (LTE), LTE Advanced, andthe Institute of Electrical and Electronics Engineers' (IEEE) 802.16standard, also known as WiMax. The use of wireless technologies with M2Mcommunications creates new opportunities for the deployment of M2Mmodules in locations less suitable for fixed-wire Internet access, butalso creates a significant new class of problems that need to be solved.

One class of problems for using M2M modules with traditional wirelessnetworks results from basic design considerations for the wirelessnetworks, where many wireless wide-area networking standards weredesigned and optimized for mobile phones, including smart phones. A coreelement of traditional wireless WAN technologies such as 3GPP and ETSIstandards over the past 20 years has included the use of a subscriberidentity module (SIM) card within 2G networks and a related universalintegrated circuit card (UICC) for 3G and 4G networks, including LTEnetworks. ETSI standards for a physical UICC as of 2013 include ETSI TR102 216. Traditionally, these cards have been supplied by a mobilenetwork operator (MNO) and contain a pre-shared secret key K in additionto a set of parameters for a mobile phone or user equipment to connectwith the wireless network operated by the MNO. The parameters couldinclude (i) an identity such as an IMSI, (ii) a set of frequencies for amobile phone to scan in order to locate a beacon signal from the MNO,(iii) a preferred access list of other MNOs in order to support roamingin locations where the MNI associated with the IMSI is not available,and (iv) many other related parameters as well. The physical media andcards in the form of a UICC can be appropriate or suitable for a mobilephone or mobile handset, where an end user can readily replace or “swapout” the physical card as the mobile phone changes geographicallocations or due to other preferences for the subscriber or end-user.Distributors of either mobile handsets or mobile phone service canphysically insert or change an appropriate UICC for the mobile phones aswell.

However, the rapid growth for “machine-to-machine” applications hascreated significant challenges to the traditional model of utilizingphysical media such as a UICC in order to provide data and parametersfor a module's connectivity to a MNO. Exemplary reasons for potentialdifficulties with physical media such as a UICC in M2M applicationsinclude (i) the modules may be installed in remote locations that aredifficult or expensive to reach after installation, such as, but notlimited to, tracking devices on shipping containers that can moveglobally, (ii) a manufacturer or service provider may prefer for themodule to be hermetically sealed for business or technical reasons,including the physical UICC may not be easily tampered with, and (iii) amodule (such as a tracking device on a 40 foot shipping container) maymove between several different countries, and the lowest costs forInternet or data connectivity through the wireless WAN may be throughutilizing different UICC cards from different operators, but the cost ofswapping the UICC card could be prohibitive.

Other needs for changing a preferred network or network credentialswithout physically changing a UICC exist as well. These needs have beenone motivation for the industry, including ETSI and 3GPP standardsbodies, to consider an embedded UICC, also known as an “eUICC”. With aneUICC, the operation of an UICC can be essentially “virtualized”, suchthat the data and algorithms within a UICC can be processed in softwareand distributed through electronic media (such as, but not limited to, afile transfer or file download). Exemplary benefits and technicalconsiderations for using an eUICC in M2M applications as of November2013 is outlined in ETSI TS 103 383 v12.1, entitled “Smart Cards;Embedded UICC; Requirements Specification,” which is herein incorporatedby reference in its entirety. Note that this published standard fromJune 2013, and the standard is primarily in the requirements definitionphase, and many of the technical specifications for implementation andoperation of an eUICC will be defined in the future.

Although the use of an embedded eUICC can solve many of the issues fordistributing and managing physical media such as a UICC, many additionalchallenges remain. Many open and remaining challenges for a eUICCpertain to securely and electronically transferring a new set of MNOnetwork access credentials (such as an IMSI and network key K) to amodule in a secure and efficient manner. A need exists in the art for amodule to securely obtain network access credentials. Another needexists in the art for the obtained credentials in a eUICC to be fullycompatible with the significant installed and legacy base of networksthat use a pre-shared secret key K, where the key K serves as thefoundation for authentication and ciphering of data for a mobile phoneor user equipment, including modules using conventional technology. Asuccessful solution to these needs for M2M applications in the form ofan eUICC can also provide a working solution of the needs for regularmobile phones as well, such that a consumer mobile phone or smartphonecould implement and utilize an eUICC in order to eliminate the costs andcomplexity of dealing with a physical UICC.

A need exists in the art for module and a mobile network operator tosecurely share a pre-shared secret key K without depending on physicaldistribution of the key K or electronic distribution of the key Kthrough 3^(rd) parties, even in an encrypted form. A need exists in theart for the decryption of data within an eUICC profile to be under thecontrol of the mobile network operator, because the mobile networkoperator may not control the distribution or release of profiles from aneUICC subscription manager to a module with an eUICC. As currentlycontemplated in November of 2013 by eUICC standards discussed above, apre-shared secret key K and related network access credentials aretransmitted to a module from an eUICC subscription manager. Thepre-shared secret key K is also known as key K in 4G LTE and relatednetworks and key Ki in 3G networks. The resulting security for theelectronically transferred, pre-shared secret key K is no stronger than(i) the encryption on the channel used to transfer key K, and (ii) thesecurity and chain of control for keys used to encrypt thecommunications channel transferring key K to a module or a mobile phone.A module and mobile network operator (MNO) using an electronicallytransferred key K for network access credentials is dependent on thecommunications channel for transferring key K, even though thatcommunications channel may be outside the control of the MNO (such as ata time when key K is transferred using another MNO or a differentnetwork). Therefore, a need exists in the art for the MNO to securelyand efficiently control the use of an electronically transferred key Kwithin a profile for an eUICC, even though copying and distributing theprofile may be outside the control of the MNO.

In addition, over an extended period of time such as several years, amobile network operator could prefer for the key K to periodicallyrotate or change for an individual module or mobile phone in order toincrease security. The continued and extended use of a single key K forall communications with a module or mobile phone can be a security risk,especially with a large volume of data transferred that could be subjectto analysis for cryptographic weaknesses by potential attackers. Recentpublications of side channel attacks for reading a security key can bemitigated by periodically rotating the key, but conventional technologyfor either UICCs or eUICCs does not support the frequent rotation of akey K. Additionally, in the future a standard key length for key K mayincrease from today's current 128 bits to a longer key length such as anexemplary 256 bits. With conventional technology where key K is recordedin physical media such as a UICC, the only feasible way to change key Kfor a module or mobile phone is to physically distribute a new UICCcard, with resulting costs and business complexities. A need exists inthe art for a module, including a mobile phone, and a MNO to securelyand efficiently support a change in network access credentials,including a key K for the module connecting to the MNO, withoutrequiring a physical replacement of a UICC or equivalent physical mediarecording a key K.

And other needs exist in the art as well, as the list recited above isnot meant to be exhaustive but rather illustrative.

SUMMARY

Methods and systems are provided for secure and efficient communicationusing a module to communicate with a server and a mobile operatornetwork. The module can support “Machine to Machine” (M2M)communications, also known as “the Internet of things”. The methods andsystems contemplated herein can also support other applications as well,including mobile phone handsets connecting to a wireless network, wherethe wireless network can be associated with or the radio access portionof a mobile network operator. A module in the present invention cancomprise a mobile phone such as a smartphone, and may also be referredto as a mobile device, mobile station, or user equipment. An objectiveof the invention is to address the challenges noted above for securingthe deployment of modules that can utilize an embedded universalintegrated circuit card (eUICC) and/or also PKI algorithms and keys.

The methods and systems contemplated herein can reduce the need formanual intervention with a module in order to automatically and remotelychange network access credentials in order for the module to utilize newor different keys in order to connect and authenticate with a wirelessnetwork. By using an eUICC, where the eUICC can support both (i) theauthentication of a user by the MNO, and (ii) the secure decryption orderivation of the key K under control of the MNO, the value andusefulness of modules can be increased for a user and a mobile operatornetwork. An eUICC can also comprise software and/or firmware componentsto “virtualize” the operation of a physical UICC, such that (i) the datanormally recorded in a physical UICC can be recorded in a file withencryption, and (ii) the steps for using the data in the file can beprocessed by an eUICC.

In a first embodiment, a mobile network operator can process a set ofdata for inclusion in a profile for an eUICC. Data within the profilecan be equivalent or similar to the data recorded in a physical UICC,including a set of network parameters, a module network identity, and afirst key K. The mobile network operator can send the data for a profileto an eUICC subscription manager. A module can include an embeddeduniversal integrated circuit card (eUICC). The eUICC can be processed byan operating system on the module and can be recorded in a nonvolatilememory, such that the eUICC is available after a powered off state. TheeUICC can include data such as an eUICC identity, an eUICC profile key,and a symmetric ciphering algorithm. A manufacturer or distributor couldrecord the data for the eUICC before the module is received by a user.The eUICC can communicate in the module with a network application. Thenetwork application can communicate with the mobile network operatorusing a wireless network and a radio within the module. The module canconnect with a first network, send the eUICC identity and receive anencrypted profile, and the module can record the encrypted profile in anonvolatile memory associated with the eUICC. The first network can be anetwork different than the wireless network for the profile, and thefirst network could comprise a WiFi network, a LAN connection using aUSB interface to the module, or a public land mobile network.

Continuing with this first embodiment, the encrypted profile as receivedby the module can include a first portion of ciphertext and a secondportion of ciphertext. The module using the eUICC can decrypt the firstportion of ciphertext using the eUICC profile key and the symmetricciphering algorithm. The resulting plaintext from the decrypted firstportion of ciphertext can include the set of network parameters, thefirst network module identity, and the first key K. The module using theeUICC can select and activate the profile in order to connect with thewireless network associated with the mobile network operator. The mobilenetwork operator can conduct a first authentication of the module usingthe first network module identity and the first key K. The networkoperated by the mobile network operator can receive an attach requestmessage, including an exemplary radio resource request message with thefirst network module identity, and the network can send a random numberin the form of a first RAND value.

Continuing with this first embodiment, the module can forward the RANDto the eUICC with the activated profile. The eUICC can input the firstRAND and the first key K into a cryptographic algorithm in order tooutput a response RES value. The eUICC can return the RES value to themodule, and the module could forward the RES to the wireless network.The wireless network can compare the received RES with a stored,expected RES (previously calculated using the same first RAND and firstkey K), and if the two RES values match then the module with the eUICCand profile can be authenticated by the network. The network and themodule can take additional steps for the module to have at least limitedaccess to an IP network. With access to the IP network for the module, auser associated with the module can conduct an authentication with themobile network operator (whereas the mobile network operator may nothave control over distribution of the profile with the network accesscredentials including the first key K up to this point).

Continuing with this first embodiment, the mobile network operator canauthenticate or verify a user or M2M service provider associated withthe module. The authentication or verification could comprise steps toverify a user, including the user entering information in a web pagethrough the IP connection established with the network in the paragraphabove using the first key K. Or the user could place a telephone call toa call center, and the user could verbally confirm identificationinformation or enter DTMF digits. Or, the MNO could authenticate orverify the identity of a user associated with the module by arepresentative of the MNO visually viewing physical identification ofthe user such as a drivers license or a passport. If the module isassociated with or operated by an M2M service provider, then the MNOcould exchange data with the M2M service provider in order to confirmthe module with the first key K is authenticated. In either case, wherethe module is associated with a user or an M2M service provider, the MNOcould take steps to authenticate with a second factor, whereauthentication with the first factor comprised receiving the RES. Aftersuccessful authentication with the second factor, the MNO can confirmthe identity of an entity associated with the module, whereas thatidentity may not be known before the authentication with the secondfactor since the distribution of the eUICC profile may be outside thecontrol of the mobile network operator.

Continuing with this first embodiment, after successful authenticationwith the second factor, the mobile network operator can send a symmetrickey to the module. The symmetric key can be encrypted with a keyciphering algorithm. Or, the symmetric key can be (i) plaintext at theapplication layer, and (ii) encrypted at the data-link layer using theencryption between the module and wireless network after the firstauthentication above with the first key K. The module can receive thesymmetric key (and decrypt the symmetric key if encrypted), andsubsequently decrypt the second portion of ciphertext in the eUICCprofile. The second portion of ciphertext can include a second networkmodule identity and a second key K. The module can convert the secondportion of ciphertext into plaintext using the symmetric cipheringalgorithm and the received symmetric key. Note that the decryption ofthe second portion of ciphertext in the profile without the symmetrickey is not feasible, and thus the mobile network operator can retaincontrol over the use of the second key K in the profile for the eUICC,such as not releasing the symmetric key until after a user hassuccessfully completed authentication with the mobile network operatoras contemplated in the paragraph above.

After decrypting the second portion of ciphertext, the module with theeUICC can read a plaintext second network module identity and second keyK. The second key K can be recorded in a protected, nonvolatile memory.The module can disconnect from the wireless network (where the firstsession used the first key K), and reconnect with the wireless networkusing the second network module identity and the second key K. Themodule with the eUICC can conduct a second authentication using thesecond key K, including sending the second network module identity,receiving a second RAND value, calculating a second RES value using thesecond RAND and the second key K, and sending the second RES value.After a successful second authentication, the module can access the IPnetwork and the public Internet through the wireless network, andsubsequent authentications with the wireless network can continue to usethe second network module identity and the second key K. For embodimentswhere the module comprises a mobile phone and the user is an individualsubscribing to mobile phone services from the mobile network operator,the user can be associated with a telephone number and place/receivephone calls after a successful second authentication.

In another embodiment, the eUICC profile key, associated with decryptingthe profile from the eUICC subscription manager, may not be recorded inthe eUICC before the eUICC sends an eUICC identity to the module, wherethe module sends the eUICC identity to the eUICC subscription managerthrough a first network. The eUICC can record an eUICC private key andthe eUICC subscription manager could record an eUICC public key. TheeUICC subscription manager can (i) encrypt the profile with the eUICCprofile key, and then (ii) encrypt the eUICC profile key with anasymmetric ciphering algorithm and the eUICC public key, where theoutput is an encrypted eUICC profile key. The eUICC can receive theencrypted eUICC profile key from the eUICC subscription manager anddecrypt the encrypted eUICC key using the asymmetric ciphering algorithmand the eUICC private key. After reading the plaintext eUICC profilekey, the eUICC can decrypt the encrypted profile using the plaintexteUICC profile key, in order to read a plaintext first key K and firstnetwork module identity.

In an exemplary embodiment, the first key K is a null value for aprofile recorded in the eUICC in a module. The use of a null value orthe number zero for a shared secret key K is contemplated in wirelessWAN standards and supported by commercial wireless networks in order tosupport emergency services for a module without a valid UICC. With anull value for the first key K, the MNO and wireless network can providelimited access to the IP network, such that a user of the module with anull or zero value for the first key K could perform steps toauthenticate or verify the user with the MNO through the IP networkaccesses with the first key K as a null value. The data-link layer maynot be effectively ciphered due to the use of a null value for the firstkey K, but the application or transport layer could secure communicationfrom a web browser on the module to a web server for the user toauthenticate with the MNO. The secure communication between the webbrowser and web server can utilize transport layer security (TLS) orsimilar standards for security at the transport or application layer,even though the data-link or network layer may not be encrypted. Aftersuccessful authentication via the web browser, the MNO can take steps(discussed in other embodiments) allowing the module with the eUICC toaccess and use a second key K and a second network module identity forsubsequent secured communication between the module and the MNO.

In another embodiment, the second key K can be derived using by both themobile network operator and the module with the eUICC using a keyderivation algorithm. The eUICC could include an eUICC key exchangealgorithm and the mobile network operator could include a MNO keyexchange algorithm, and the key exchange algorithms can include a keyderivation algorithm that accepts input of a token value, a private key,and a public key for the other node. The mobile network operator and themodule with the eUICC could communicate the token value used for the keyderivation algorithm (including using the connectivity through thewireless network after using the first key K in the profile). The modulecan record an eUICC private key, and the MNO can have access to theeUICC public key. The key derivation algorithm in the eUICC key exchangealgorithm can output a second key K using the token. The MNO can obtainthe same value for the second key K. In this manner, both node canderive the same second key K without electronically transferring thesecond key K, even in encrypted form and thereby increasing the securityof a systems with an eUICC.

An exemplary embodiment can support a module changing a key K used to(i) authenticate with a wireless network and (i) cipher/decipher datawith a wireless network. The module can change key K without requiringthe manual exchange of a UICC or other physical intervention. The modulecan use an eUICC profile and change key K while using the same eUICCprofile. The module, could also comprise a mobile phone such as, but notlimited to, a smart phone. After connecting with a first network, whichcould comprise a first wireless WAN, wireless LAN, or wired connection,the module can receive a eUICC profile for an eUICC in the module, wherethe eUICC profile includes a first network module identity and a firstkey K. The first key K can be a standards-based key K used with wirelessnetworks, and be equivalent to a pre-shared secret key K recorded inphysical UICCs for LTE networks.

After authenticating with the wireless network using the first key K,the module and MNO can share a token. The module and MNO can mutuallyderive a second key K using the token and a key derivation algorithm.The module can disconnect from the wireless network after attachingusing the first key K, and then reconnect using the second key K whichhas now been mutually derived by both the module and the mobile networkoperator. The module or MNO could determine or evaluate if the use of anew key K is required or preferred, and share a new token for input intothe key derivation algorithms to derive a mutually shared new key K. Inthis manner, a module can change the key K used to authenticate andcipher/decipher data with a wireless network from a first key K to asecond key K. This can increase flexibility of the system and reducecosts of physically distributing a new UICC to the module (orelectronically sending new eUICC profiles) in order to change a key K.

These as well as other aspects and advantages will become apparent tothose of ordinary skill in the art by reading the following detaileddescription, with reference where appropriate to the accompanyingdrawings.

BRIEF DESCRIPTION OF THE DRAWINGS

Various exemplary embodiments are described herein with reference to thefollowing drawings, wherein like numerals denote like entities.

FIG. 1a is a graphical illustration of an exemplary system that includesa module and a mobile network operator, in accordance with exemplaryembodiments;

FIG. 1b is a graphical illustration of hardware, firmware, and softwarecomponents for a module, in accordance with exemplary embodiments;

FIG. 1c is a graphical illustration of components within a module, inaccordance with exemplary embodiments;

FIG. 1d is a graphical illustration of hardware, firmware, and softwarecomponents for a server, in accordance with exemplary embodiments;

FIG. 1e is a graphical illustration of an exemplary system that includesa module, a mobile network operator, and an eUICC in accordance withexemplary embodiments;

FIG. 2a is a graphical illustration of an exemplary profile for aneUICC, including encrypted data, decryption steps, and decrypted datafor the profile, in accordance with exemplary embodiments;

FIG. 2b is a graphical illustration for ciphering and deciphering aprofile using a symmetric ciphering algorithm with input of a key, inaccordance with exemplary embodiments;

FIG. 2c is a graphical illustration for ciphering and deciphering a keyK using a symmetric ciphering algorithm with input of a key, inaccordance with exemplary embodiments;

FIG. 2d is a graphical illustration of a public key and a private keyfor an eUICC, in accordance with exemplary embodiments;

FIG. 2e is a graphical illustration for ciphering and deciphering a keyfor an eUICC using an asymmetric ciphering algorithm and a PKI key pair,in accordance with exemplary embodiments;

FIG. 3 is a simplified message flow diagram illustrating an exemplarysystem with exemplary data sent and received by a module with an eUICC,in accordance with exemplary embodiments;

FIG. 4 is a flow chart illustrating exemplary steps for a module to usean eUICC and authenticate with a wireless network, in accordance withexemplary embodiments;

FIG. 5a is a graphical illustration of public keys, private keys, and akey derivation algorithm, in accordance with exemplary embodiments;

FIG. 5b is a graphical illustration of deriving a second key K usingpublic keys, private keys, and a key derivation algorithm, in accordancewith exemplary embodiments;

FIG. 5c is a simplified message flow diagram illustrating an exemplarysystem with exemplary data sent and received by a module with an eUICC,in accordance with exemplary embodiments;

FIG. 6 is a flow chart illustrating exemplary steps for a module to usean eUICC and authenticate with a wireless network, in accordance withexemplary embodiments, and,

FIG. 7 is a simplified message flow diagram illustrating an exemplarysystem with exemplary data sent and received by a network, in accordancewith exemplary embodiments.

DETAILED DESCRIPTION OF EXEMPLARY EMBODIMENTS OF THE INVENTION

FIG. 1a

FIG. 1a is a graphical illustration of an exemplary system that includesa module and a mobile network operator, in accordance with exemplaryembodiments. The system 100 includes a module 101 operating within awireless network 102. System 100 can also include a mobile networkoperator 104, an IP Network 111, and an eUICC subscription manager 109.Mobile network operator (MNO) 104 can include a server 105. Forembodiments where the MNO 104 uses 4G LTE and LTE Advanced networks,server 105 could comprise a home subscriber server (HSS) and/or amobility management entity (MME). Server 105 could be a server withrelated functionality as a HSS or MME for a MNO 104 that uses differentwireless network standards than those based on 4G LTE. Although notillustrated in FIG. 1a , a MNO 104 may also include one or more servers105, such that a first server 105 could function as an HSS in 4G LTE andLTE Advanced networks and a second server 105 could function as a MME in4G LTE and LTE Advanced networks.

System 100 is illustrated without specific packet transmissions betweenmodule 101 and mobile network operator 104 and eUICC subscriptionmanager 109. Examples of the communications and messages pertaining tothe present invention will be illustrated in later Figures. Ascontemplated herein, machine-to-machine communications may comprisecommunication between a module 101 and a server 105, such that data canbe transferred between the two with minimal manual intervention,although manual intervention can be required to set up system 100 andany occasional manual maintenance required. As contemplated herein,machine-to-machine communications may also be referred to as “theInternet of things” (IoT). Also note that module 101 may comprise awireless module, such that module 101 can communicate with wirelessnetwork 102 using a radio and an antenna. A wireless or a wiredconfiguration for module 101 can be utilized in the present invention.

If module 101 operates as a wireless module, module 101 and wirelessnetwork 102 can communicate using a base station 103. Module 101 andwireless network 102 can utilize a variety of wireless technologies tocommunicate, including WiFi, WiMax, a 2nd generation wireless wide areanetwork (WAN) technology such as, but not limited to, General PacketRadio Services (GPRS) or Enhanced Data rates for GSM Evolution (EDGE),3rd Generation Partnership Project (3GPP) technology such as, but notlimited to, 3G, 4G LTE, or 4G LTE Advanced, and other examples exist aswell including wireless networks based on WiMAX standards. A wiredmodule 101 can connect to the IP Network 111 via a wired connection suchas, but not limited to, an Ethernet, a fiber optic, or a UniversalSerial Bus (USB) connection (not shown).

Generally, the communication techniques described herein can beindependent of the network technologies utilized at the physical anddata-link layers, so long as the underlying network provides access tothe IP Network 111 and supports Internet Protocols (IP). The IP Network111 can be an IPv4 or an IPv6 packet-switched based network thatutilizes standards derived from the Internet Engineering Task Force,such as, but not limited to, RFC 786 (User Datagram Protocol), RFC 793(Transmission Control Protocol), and related protocols. The IP Network111 can be the public Internet comprising globally routable IPaddresses, or a private network that utilizes private IP addresses. IPNetwork 111 as illustrated in FIG. 1a could comprise the globallyroutable public Internet, or IP Network 111 could also be a privateInternet that is (i) not globally routable and (ii) only accessible toauthorized modules and servers. As one example of a private IP Network111, IP Network 111 could use private IP addresses for nodes on thenetwork, and in this case IP Network 107 could be referred to as anintranet or private network. Alternatively, IP Network 111 could be aprivate network layered on top of the publicly routable Internet viasecured and encrypted connections. The specific numbers for IP addressesand port numbers shown in FIG. 1a and other figures are illustrative andany valid IP address or port number can be used, including an IPv4 andan IPv6 address. Server 105 within mobile network operator 104 cancommunicate with the module 101 using IP network 111, where IP network111 can comprise a private network that utilizes Internet Protocolstandards. Module 101 can access the public Internet afterauthenticating with the server 105 associated with the MNO 104.

When operating in a wireless network configuration, module 101 canaccess the IP Network 111 via the wireless network 102. In the wirelessnetwork configuration, module 101 can be a wireless handset, a cellularphone, a smartphone, a tablet computer, a laptop, a computer with aradio, a tracking device, or a circuit board with a radio that accesseswireless network 102. Examples of wireless modules that utilize awireless WAN such as, but not limited to, 2G and 3G networkingtechnologies include the Motorola® G24-1 and Huawei® MC323. Examplemanufacturers of wireless modules in 2012 include Sierra Wireless® andTelit®. Example leading manufacturers of mobile phones in 2013 includeApple® and Samsung®. In a wired configuration (not shown), module 101can be a computer, security camera, security monitoring device,networked controller, etc. Module 101 can include a module identity 110,which can comprise a serial number or identity code in order to identifyan individual, specific module 101 among a plurality of modules 101. Amore detailed depiction of exemplary components of a module 101 isincluded in FIG. 1b and FIG. 1c below. Module 101 could also operate asa “smartcard” such that an end user presents module 101 to merchants forpayments.

Wireless network 102 may comprise either a wireless local area network(LAN) or a wireless WAN such as a public land mobile network (PLMN).Examples for technologies used in wireless LANs include an 802.11 WLAN,Bluetooth, or Zigbee among other possibilities. Module 101 operating inwireless mode could communicate with a base station 103 of a wirelessnetwork 102 using a radio and an antenna. Wireless network 102 couldoperate as a Mode II device according to FCC Memorandum Opinion andOrder (FC-12-36) and related white space regulation documents. If module101 supports IEEE 802.15.4, then wireless network 102 could be a Zigbeenetwork, an ISA100.11a standards-based network, or a 6LoWPAN network asdescribed by IETF RFC 4944. Other possibilities exist as well for thewireless technology utilized by a wireless network 102 and module 101,operating in a wireless mode, without departing from the scope of thepresent invention.

System 100 can include an eUICC subscription manager 109, where an eUICCsubscription manager 109 can manage the recording and securedistribution of eUICC profiles 107 c to a module 101. Example entitiesthat could operate or control an eUICC subscription manager 109 includea manufacturer of module 101, an M2M service provider 115 that managesthe operation of module 101, or possibly a mobile network operator 104could operate the eUICC subscription manager 109. Other entities couldoperate as an eUICC subscription manager 109 as well. An exemplary eUICCsubscription manager 109 is described in ETSI TS 103 383 v12.1, entitled“Smart Cards; Embedded UICC; Requirements Specification,” which isherein incorporated by reference in its entirety. An eUICC subscriptionmanager 109 can also use a server 105 and record private keys and publickeys for the server/subscription manager operation (including exemplarykeys depicted and described in connection with FIG. 2d below).

In exemplary embodiments, eUICC subscription manager 109 can use aneUICC profile key 107 b to cipher portions of an eUICC profile 107 c,such that only module 101 with the same eUICC profile key 107 b couldreasonably decipher the portions of the eUICC profile 107 c. In thismanner, the eUICC profile 107 c can remain reasonably secured. The eUICCsubscription manager 109 can share the eUICC profile key 107 b inseveral different ways, including (i) pre-sharing the eUICC profile key107 b, or (ii) the eUICC subscription manager 109 sending the eUICCprofile key 107 b to the eUICC 107 using an asymmetric cipheringalgorithm 219 as depicted and described in connection with FIG. 2ebelow. An eUICC profile 107 c can include an eUICC profile identity 107e in order to identify a profile among a plurality of eUICC profiles 107c. An eUICC subscription manager 109 can include an address 109 a. Theaddress 109 a could comprise a domain name, such that a domain namesystem (DNS) or secure DNS (DNSSEC) query could resolve the name into anIP address in order for module 101 to communicate with the eUICCsubscription manager 109. Or the address 109 a could comprise anInternet Protocol (IP) address, and the address 109 a could include orbe associated with a port number, such as port number 443 for data thatutilizes transport layer security.

An eUICC 107 within module 101 can comprise an embedded universalintegrated circuit card (eUICC) 107. An eUICC 107 can provide theequivalent functionality as a physical UICC, where definitions for aphysical UICC are included in ETSI TR 102 216 and ETSI TS 102 221V11.0.0, and other examples for the use of a physical UICC in mobilephones and M2M modules exist as well. An eUICC 107 in FIG. 1a cansupport exemplary requirements for an eUICC outlined in ETSI TS 103 383v12.1, entitled “Smart Cards; Embedded UICC; RequirementsSpecification,” which is herein incorporated by reference in itsentirety. In other words, an eUICC 107 can operate as a “virtualized”UICC, such that data operations and input/output to a physical UICC canbe provided by an eUICC 107. An eUICC 107 can include an eUICC identity107 a, such that an eUICC subscription manager 109 can select andidentify the eUICC 107 among a plurality of eUICCs 107. The eUICC 107can also record an eUICC profile key 107 b and an eUICC profile 107 d.Profile 107 d can represent a profile that is partially decrypted usingthe eUICC profile key 107 b, as depicted and described in connectionwith FIG. 2a below. Additional exemplary details for the operation of aneUICC 107 within module 101 are also provided in FIG. 1b , FIG. 1c , andFIG. 1e below.

According to an exemplary embodiment, an eUICC 107 can be recorded andoperate within a “eUICC supporting” physical universal integratedcircuit card (UICC) 108 within module 101. This “eUICC supporting”,physical UICC 108 can include a processing unit, RAM memory, ROM memory,EEPROM memory, a bus, and a physical interface (not shown in FIG. 1a ,but described in FIG. 1b ). An exemplary processing unit, RAM memory,ROM memory, EEPROM memory, and bus are depicted and described inconnection with FIG. 1b below. The “eUICC supporting” physically UICC108 can perform all of the functions of an eUICC 107, including (i)receiving and recording profiles 107 d, (ii) receiving and recordingeUICC profile keys 107 b, (iii) recording an eUICC identity 107 e, (iv)decrypting an eUICC profile 107 c into an eUICC profile 107 d asdepicted and described in connection with FIG. 2a below, (v) recording aset of network parameters 201 (in FIG. 2a below) for module 101 toconnect with wireless network 102, and (vi) recording keys such as a keyK for conducting a message digest authentication with wireless networkas depicted and described in FIG. 3 below. An “eUICC supporting”physical UICC 108 can include a physical electrical interface of ISO/IEC7816-3 in order to support existing physical slots for UICCs. The use ofan “eUICC supporting” physical UICC 108 is optional, and can be omitted.In this case (where “eUICC supporting” physical UICC 108 is omitted),the eUICC 107 can operate as a program within module 101 as depicted anddescribed in connection with FIG. 1b below, and the eUICC 107 would notreside within the “eUICC supporting” physical UICC 108.

The physical form-factor for an “eUICC supporting” UICC 108 could beidentical to a UICC, and a difference between the two may not even beapparent upon visual inspection without special markings on the card.The physical form-factor for an “eUICC supporting” UICC 108 couldcomprise a “micro-SIM” or a “nano-SIM” as defined in ETSI TS 102 221V11.0.0, which is herein incorporated by reference. When the module 101detects a “eUICC supporting” UICC 107, the module 101 could sendreceived eUICC profiles 107 c to the “eUICC supporting” UICC 107, andalso select, deselect, activate, and deactivate the different receivedeUICC profiles 107 d recorded in the “eUICC supporting” UICC 108. When amodule 101 detects that a regular UICC (i.e. not an “eUICC supporting”UICC 108) has been loaded into a slot for UICCs within the module, themodule 101 could access the UICC in a regular manner implemented bymobile phones and modules for connecting to existing wireless networksin 2013, such as LTE or 3G networks.

A module 101 can be associated with a user 113 or an M2M serviceprovider 115. A user 113 could be a subscriber to mobile phone servicesprovided by the mobile network operator 104. In this case, the usercould be an individual and the module 101 could comprise a mobile phonewith a telephone number, an email client, and a web browser (in additionto other, standard functionality for a mobile phone). The user 113 couldperiodically charge the module 101 (which can comprise a mobile phone),such as typically at night and carry the module 101 during the day inorder to place calls and send/receive data. Thus, the user 113 maytypically be physically close to a mobile phone as module 101, but anM2M service provider 115 can be associated with module 101 but may notbe physically close to module 101. For embodiments where module 101 isassociated with M2M communications, such as including a sensor tocollect data regarding a monitored unit, the module 101 can beassociated with an M2M service provider 115. In this case, the M2Mservice provider 115 can be a company or a division or department withina larger company that is associated with a plurality of modules 101 forcollecting data using sensors and sending the data to a server similarto server 105. The M2M service provider 115 may operate the serversimilar to server 105 in order to automatically collect data from theplurality of modules 101. The server for the M2M service provider 115could communicate with module 101 using the IP network 111 and thewireless network 102 when module 101 is connected to the wirelessnetwork 102.

Other configurations besides the one illustrated in FIG. 1a are possibleas well. In many common commercial relationships for the operation ofmobile phone service in the United States in 2013, wireless network 102could represent a portion of the radio access network used by a mobilenetwork operator 104. MNO 104 could outsource portions of the operationand maintenance of a radio access network, such as a wireless network102, to 3^(rd) parties. In this configuration, wireless network 102could represent a network operated by a first company specializing inthe operation of radio towers and BTS equipment. This first companycould be contracted with the mobile network operator 104 in order tosupport mobile phone service or data services to modules 101.

In addition, server 105 could reside within wireless network 102 in adata center managed by wireless network 102. Wireless network 102 couldalso operate as an eUICC subscription manager 109. Although a singlemodule 101, server 105, wireless network 102, and mobile networkoperator 104 are illustrated in FIG. 1a , system 100 could comprise aplurality of each of these elements. Module 101 could also record sensordata pertaining to a monitored unit (not shown). Module 101 could bemobile, such as physically attached to a truck or a pallet, and module101 could connect to a series of different wireless networks 102 or basestations 103 as module 101 moves geographically. Other configurationsare possible as well for the elements illustrated in FIG. 1a withoutdeparting from the scope of the present invention.

FIG. 1b

FIG. 1b is a graphical illustration of hardware, firmware, and softwarecomponents for a module, in accordance with exemplary embodiments. FIG.1b is illustrated to include many components that can be common within amodule 101, and module 101 may also operate in a wireless configurationin order to connect with a wireless network 102. In a wirelessconfiguration, the physical interface 101 a of module 101 may supportradio-frequency (RF) communications with networks including a wirelessnetwork 102 via standards such as, but not limited to, GSM, UMTS, mobileWiMax, CDMA, LTE, LTE Advanced, and/or other mobile-networktechnologies. In a wireless configuration, the physical interface 101 amay also provide connectivity to local networks such as, but not limitedto, 802.11 WLAN, Bluetooth, or Zigbee among other possibilities. In awireless configuration, module 101 could use a physical interface 101 abe connected with both a wireless WAN and wireless LAN simultaneously.In a wired configuration, the physical interface 101 a can provideconnectivity to a wired network such as, but not limited to, through anEthernet connection or USB connection. As contemplated herein, aphysical interface 101 a can include a network interface (such as aradio or an Ethernet port), such that module 101 can use the networkinterface in order to connect with a network and communicate with thenetwork. A network interface can also comprise a physical interface 101a as contemplated herein.

The physical interface 101 a can include associated hardware to providethe connections such as, but not limited to, radio-frequency (RF)chipsets, a power amplifier, an antenna, cable connectors, etc., andadditional exemplary details regarding these components are describedbelow in FIG. 1c . Device driver 101 g can communicate with the physicalinterfaces 101 a, providing hardware access to higher-level functions onmodule 101. Device drivers 101 g may also be embedded into hardware orcombined with the physical interfaces 101 a. Module 101 may preferablyinclude an operating system 101 h to manage device drivers 101 g andhardware resources within module 101. The operating systems describedherein can also manage other resources such as, but not limited to,memory and may support multiple software programs operating on module101 at the same time.

The operating system 101 h can include Internet protocol stacks such as,but not limited to, a User Datagram Protocol (UDP) stack, TransmissionControl Protocol (TCP) stack, a domain name system (DNS) stack, etc.,and the operating system 101 h may include timers and schedulers formanaging the access of software to hardware resources. The operatingsystem shown of 101 h can be appropriate for a low-power device withlimited memory and CPU resources (compared to a server 105). An exampleoperating system 101 h for module 101 includes Linux, Android® fromGoogle®, Windows® Mobile, or Open AT® from Sierra Wireless®. Additionalexample operating systems 101 h for module 101 include eCos, uC/OS,LiteOs, and Contiki, and other possibilities exist as well withoutdeparting from the scope of the present invention.

A module program 101 i may be an application programmed in a languagesuch as, but not limited to, C, C++, Java, and/or Python, and couldprovide functionality to support regular mobile phone functionality. Themodule program 101 i could include a network application 101 x, wherenetwork application 101 x comprises the user equipment protocol foraccessing and communicating with the wireless network 102. Forembodiments where module 101 connects with a wireless network 102comprising an LTE network, the network application 101 x can receive,process, and send signals with the wireless network 102 for userequipment messages in ETSI TS 136 331 v.10.7 entitled “LTE; EvolvedUniversal Terrestrial Radio Access (E-UTRA); Radio Resource Control(RRC); Protocol Specification”, which is herein incorporated byreference. In other words, network application 101 x can comprisesoftware for accessing and communicating with the wireless network 102.Although network application 101 x is depicted in FIG. 1b as operatingas software within RAM memory 101 e, the network application 101 x couldbe included in firmware or a processor or application associated with aradio 101 z (described in FIG. 1c ). Exemplary messages sent andreceived by a network application 101 x are also depicted and describedin connection with FIG. 3 below.

A module program 101 i could also include software for M2M applicationssuch as, but not limited to, remote monitoring of sensors and remoteactivation of actuators. Module program 101 i could also include asoftware routine, subroutine, linked library, or software module,according to one preferred embodiment. As contemplated herein, a moduleprogram 101 i can include an application operating within a smartphone,such as, but not limited to, an iPhone® or Android®-based smartphone,and in this case module 101 could comprise a smartphone. The applicationfunctioning as a module program 101 i could be downloaded from an “appstore” associated with the smartphone. A set of device drivers 101 gcould include an eUICC driver 129, such that a network application 101 xor other software or firmware within module 101 communicating with theeUICC 107 could send and receive data with the eUICC driver 129.

Many of the logical steps for operation of module 101 or eUICC 107 canbe performed in software and hardware by various combinations ofphysical interface 101 a, device driver 101 g, operating system 101 h,and a module program 101 i. As depicted in FIG. 1b , module program 101i can include an eUICC 107 and a network application 101 x. When module101 or eUICC 107 is described herein as performing various actions suchas acquiring an IP address, connecting to the wireless network,monitoring a port, transmitting a packet, sending a message, receiving aresponse, or encrypting or signing data, specifying herein that module101 or eUICC 107 performs an action can refer to software, hardware,and/or firmware operating within module 101 illustrated in FIG. 1b orFIG. 1c performing the action.

Note that module 101 may also optionally include user interface 101 jwhich may include one or more devices for receiving inputs and/or one ormore devices for conveying outputs. User interfaces are known in the artand thus user interfaces are not described in detail here. Userinterface 101 j could comprise a touch screen if module 101 operates asa smartphone or mobile phone. For embodiments where module 101 comprisesa module for M2M applications and is associated with an M2M serviceprovider 115, then module 101 can optionally omit a user interface 101j, since no local user 113 input may be required for many M2Mapplications, although a user interface 101 j could be included withmodule 101. For embodiments where module 101 comprises a mobile phoneand is associated with a user 113, the user interface 101 j couldcomprise a touch screen on the front of a mobile phone.

Module 101 may be a computing device that includes computer componentsfor the purposes of collecting data from a sensor 101 f or triggering anaction by an actuator 101 y. Module 101 may include a central processingunit (CPU) 101 b, a random access memory (RAM) 101 e, and a system bus101 d that couples various system components including the random accessmemory 101 e to the processing unit 101 b. The system bus 101 d may beany of several types of bus structures including a memory bus or memorycontroller, a peripheral bus, and a local bus using any of a variety ofbus architectures including a data bus. Note that the computercomponents illustrated for the module 101 in FIG. 1b may be selected inorder to minimize power consumption and thereby maximize battery life,if module 101 includes a battery and is not attached to external power.In addition, the computer components illustrated for the module 101 inFIG. 1b may also be selected in order to optimize the system for bothlong periods of sleep or idle states relative to active communicationsand also may be optimized for predominantly uplink (i.e. device tonetwork) communications with small packets or messages. The computercomponents illustrated for the module 101 in FIG. 1b may also begeneral-purpose computing components, and specialized components may notbe required in order to utilize many of the embodiments contemplatedherein.

Module 101 may include a read-only memory (ROM) 101 c which can containa boot loader program. Although ROM 101 c is illustrated as “read-onlymemory”, ROM 101 c could comprise long-term memory storage chipsets orphysical units that are designed for writing once and reading manytimes. As contemplated within the present invention, a read-only addresscould comprise a ROM 101 c memory address or another hardware addressfor read-only operations accessible via bus 101 d. Changing datarecorded in a ROM 101 c can require a technician have physical access tomodule 101, such as, but not limited to, removing a cover or part of anenclosure, where the technician can subsequently connect equipment to acircuit board in module 101, including replacing ROM 101 c. ROM 101 ccould also comprise a nonvolatile memory, such that data is storedwithin ROM 101 c even if no electrical power is provided to ROM 101 c.Although not illustrated in FIG. 1b , but illustrated in FIG. 1c below,module 101 could also include a flash memory 101 w. Module program 101i, network application 101 x, operating system 101 h, eUICC 107, ordevice drivers 101 g could be stored in flash memory 101 w within module101 when the module is powered off. These components and/or instructionscould be moved from a flash memory 101 w (not shown in FIG. 1b but shownin FIG. 1c ) into RAM 101 e when the module is powered on by abootloader program recorded in the ROM 101 c. Note that ROM 101 c couldbe optionally omitted or included in a memory unit within CPU 101 b (notshown).

Although the exemplary environment described herein employs ROM 101 cand RAM 101 e, it should be appreciated by those skilled in the art thatother types of computer readable media which can store data that isaccessible by a module 101, such as, but not limited to, memory cards,subscriber identity module (SIM) cards, local miniaturized hard disks,and the like, may also be used in the exemplary operating environmentwithout departing from the scope of the invention. The memory andassociated hardware illustrated in FIG. 1b provide nonvolatile storageof computer-executable instructions, data structures, program modules,module program 101 i, and other data for computer or module 101. Notethe module 101 may include a physical data connection at the physicalinterface 101 a such as, but not limited to, a miniaturized universalserial bus adapter 101 v (illustrated in FIG. 1c ), firewire, optical,or other another port.

The computer executable instructions such as, but not limited to, moduleprogram 101 i, network application 101 x, eUICC 107, operating system101 h, or device driver 101 g can be initially loaded into memory suchas, but not limited to, ROM 101 c or RAM 101 e through the physicalinterface 101 a before module 101 is given to an end user, shipped by amanufacturer to a distribution channel, or installed by a technician. Inaddition, the computer executable instructions such as, but not limitedto, module program 101 i, network application 101 x, operating system101 h or device driver 101 g could be transferred wirelessly to module101. In either case (wired or wireless transfer of computer executableinstructions), the computer executable instructions such as moduleprogram 101 i, network application 101 x, operating system 101 h, ordevice driver 101 g could be stored remotely on a disk drive, solidstate drive, or optical disk (external drives not shown).

A number of program modules may be stored in RAM 101 e, ROM 101 c, orpossibly within CPU 101 b, including an operating system 101 h, devicedriver 101 g, an http client (not shown), a DNS client, and relatedsoftware. Further, the module program 101 i and/or network application101 x can perform the various actions described in the present inventionfor the module 101 through instructions the module program 101 i and/ornetwork application 101 x provide to the CPU 101 b. A user may entercommands and information into module 101 through an optional userinterface 101 j, such as a keypad, keyboard (possibly miniaturized for amobile phone form-factor), and a pointing device. Pointing devices mayinclude a trackball, an electronic pen, or a touch screen.

The module 101, comprising a computer, may operate in a networkedenvironment using logical connections to one or more remote computers,such as the server 105 illustrated in FIG. 1a . Server 105 can alsofunction as a general purpose server to provide files, programs, diskstorage, remote memory, and other resources to module 101 usuallythrough a networked connection. Additional remote computers with whichmodule 101 communicates may include another module 101 or mobile device,an M2M node within a capillary network, a personal computer, otherservers, a client, a router, a network PC, a peer device, a base station103, or other common network node. It will be appreciated that thenetwork connections shown throughout the present invention are exemplaryand other means of establishing a wireless or wired communications linkmay be used between mobile devices, computers, servers, correspondingnodes, and similar computers. Although a single module program 101 i isdepicted in FIG. 1b , module 101 could include a plurality of moduleprograms 101 i.

The module program 101 i, eUICC 107, and network application 101 xoperating within module 101 illustrated in FIG. 1b can provide computerexecutable instructions to hardware such as CPU 101 b through a systembus 101 d in order for a module 101 to (i) connect with a wirelessnetwork 102, (ii) authenticate with a mobile network operator 104associated with the wireless network 102, and (iii) send or receivepackets with a server 105 or a server associated with an eUICCsubscription manager 109. The module program 101 i and/or networkapplication 101 x can enable the module 101 or eUICC 107 to transmit orsend data from the eUICC 107 or module 101. The eUICC 107 or module 101can send data by recording data in memory such as RAM 101 e, where thedata can include cryptographic data such as a RAND and RES values, adestination IP:port number, a packet or packet header value, anencryption or ciphering algorithm and key, a digital signature algorithmand key, etc. The data recorded in RAM 101 e can be subsequently read bythe operating system 101 h or the device driver 101 g. The operatingsystem 101 h or the device driver 101 g can write the data to a physicalinterface 101 a using a system bus 101 d in order to use a physicalinterface 101 a to send data to the wireless network 102 and IP network111 using a radio 101 z (shown in FIG. 1c ). Alternatively, the moduleprogram 101 i and/or network application 101 x can write the datadirectly to the physical interface 101 a using the system bus 101 d.

The module program 101 i, eUICC 107, network application 101 x, and/oroperating system 101 h can include steps to process the data recorded inmemory such as, but not limited to, encrypting data, selecting adestination address, or decrypting ciphertext data. The data recorded inmemory could also include an eUICC profile 107 c or eUICC profile 107 d,as described in FIG. 1a above and FIG. 2a below. The eUICC profiles 107d can include instructions and data for connecting with wireless network102, including network parameters and network access credentials. Themodule 101 can use the physical interface 101 a such as, but not limitedto, a radio to transmit or send the data associated with a profile 107 dto a base station 103. For those skilled in the art, other steps arepossible as well for a module program 101 i or operating system 101 h tocommunicate with a wireless network 102 using data associated with anUICC (where an eUICC 107 records data normally associated with aphysical UICC) without departing from the scope of the presentinvention.

Conversely, in order for module 101, network application 101 x, or eUICC107 to receive a packet or message from MNO 104 or wireless network 102,the physical interface 101 a can use a radio to receive data from a basestation 103. The received data can include information from MNO 104 andmay comprise a datagram, a source IP:port number, a packet or headervalue, an instruction for module 101, an acknowledgement to a packetthat module 101 sent, a digital signature, and/or encrypted data. Thereceived data can also include radio resource control (RRC) messages,and related layer 1 and layer 2 access and control messages for module101 to access the wireless network 102. The operating system 101 h ordevice driver 101 g can use a system bus 101 d and CPU 101 b to recordthe received data in memory such as RAM 101 e, and the module program101 i or operating system 101 h may access the memory in order toprocess the received data and determine the next step for the module 101after receiving the data. The steps within this paragraph may alsodescribe the steps a module program 101 i, eUICC 107, or networkapplication 101 x can perform in order to receive a message fromwireless network 102 that includes a RAND value. For those skilled inthe art, other steps are possible as well for a module program 101 i,network application 101 x, module 101, and/or eUICC 107 to receive amessage from a mobile network operator 104 or wireless network 102within the scope of the present invention.

Module program 101 i can include an eUICC 107, which can provide thefunctionality or CPU 101 b instructions for module 101 to access datanormally within a physical UICC, such as network parameters and networkaccess credentials. An eUICC 107 as illustrated in FIG. 1a and FIG. 1bcan be implemented within module 101 in several different ways,including (i) as depicted in FIG. 1b a module program 101 i stored inRAM 101 e during operation, but also recorded in a nonvolatile memory,such as, but not limited to, either flash memory 101 w (described inFIG. 1c ) or ROM 101 c at other times than normal operation (such asduring periods of power off), (ii) firmware within CPU 101 b or anotherspecialized processing unit within module 101, (iii) an “eUICCsupporting” physical UICC 108 within module 101 that contains the eUICC107, or (iv) a specialized circuit within a surface mount package thatis soldered directly onto a circuit board of the module 101, includingan 8-lead small outline non-leaded (SON-8) package. For the embodimentwhere an eUICC 107 comprises a module program 101 i, the eUICC 107 couldbe loaded and installed within nonvolatile memory 101 w in module 101using the steps and procedures described for a module program 101 i inFIG. 1b . Other possibilities exist as well for the physicalimplementation of an eUICC 107 within a module 101 without departingfrom the scope of the present invention. An eUICC 107 may also bereferred to as an “electronic UICC”, an “electronic SIM” (eSIM), or an“embedded SIM” (also eSIM).

For embodiments where an eUICC 107 can be loaded into a RAM 101 e orflash 101 w memory, a CPU 101 b could designate the RAM 101 e or flash101 w memory containing the instructions or data for an eUICC 107 to bea protected memory. When (i) loaded with appropriate data (such as, butnot limited to a eUICC profile 107 d described in FIG. 2a below), and(ii) a profile for a MNO 104 is selected and activated, then an eUICC107 can provide the equivalent functionality of a physical UICC. TheeUICC 107, using an activated eUICC profile 107 d, can provide themodule 101 with (i) network access credentials 202 and 203, and (ii)network parameters 201 in order to connect with wireless network 102.The eUICC 107, using an activated eUICC profile 107 d, can record afirst key K 203 (described in FIGS. 2a and 3 below) and also a firstnetwork module identity 202. The eUICC 107 can support standard steps bymodule 101 for network authentication contemplated in 3GPP TS 33.401V12.9.0 and related standards, including inputting a RAND value into theeUICC 107 and outputting a RES value.

Moreover, those skilled in the art will appreciate that the presentinvention may be implemented in other computer system configurations,including hand-held devices, netbooks, portable computers,multiprocessor systems, microprocessor based or programmable consumerelectronics, network personal computers, minicomputers, mainframecomputers, and the like. The invention may also be practiced indistributed computing environments, where tasks are performed by remoteprocessing devices that are linked through a communications network. Ina distributed computing environment, program modules may be located inboth local and remote memory storage devices. In addition, the terms“mobile node”, “mobile station”, “mobile device”, “M2M module”, “M2Mdevice”, “networked sensor”, “industrial controller”, or “userequipment” can also refer to module 101 or its functional capabilities.Other possibilities exist as well for the configuration or combinationof components illustrated in FIG. 1b without departing from the scope ofthe present invention.

FIG. 1c

FIG. 1c is a graphical illustration of components within a module, inaccordance with exemplary embodiments. FIG. 1c is illustrated to show acombination of components useful for leveraging the efficient and securecommunication techniques described in the present invention. In additionto the components illustrated in FIG. 1b above, module 101 can include aan eUICC 107, a battery 101 k, a MNO public key 502, a wireless moduleprivate key 112 a, a connection to an actuator 101 y, a USB interface101 v, a CPU wake controller 101 u, a flash memory 101 w, a symmetrickey 127, a random number generator 128, cryptographic algorithms 141, aradio 101 z, and other components illustrated in FIG. 1c . Not all ofthe components illustrated in FIG. 1c are required for many exemplaryembodiments, and some of the components illustrated in FIG. 1c may alsobe optionally omitted in some exemplary embodiments.

The CPU 101 b can comprise a general purpose processor appropriate forthe low power consumption requirements of a module 101, and may alsofunction as a microcontroller. CPU 101 b could be a processor with anARM® core, or possibly an ATOM® core or processors, and otherpossibilities exist as well. The CPU 101 b can include registers, acache memory, and arithmetic logic units. Clock 160 can comprise acrystal oscillator generating sine or square wave outputs at a frequencyto drive a system bus 101 d, CPU 101 b, and RAM 101 e, in addition toother functionality. In exemplary embodiments, clock 160 can comprise atemperature-compensated crystal oscillator (TCXO), a voltage-controlledcrystal oscillator (VCXO), or a voltage-controlledtemperature-compensated crystal oscillator (VCTCXO), and otherpossibilities exist as well. Clock 160 could include circuits and logicto keep time while module 101 is both in an active state and a dormantstate.

Sensor 101 f could be a device to collect environmental data or dataregarding (i) a monitored unit for M2M applications or (ii) user 113 forapplications where module 101 comprises a mobile phone and user 113 isan individual person such as a mobile phone subscriber. Sensor 101 fcould collect data such as, but not limited to, temperature, humidity,pressure, visible light levels, radiation, shock and/or vibration,voltage, current, weight, pH levels, orientation/motion, or the presenceof specific chemicals. Sensor 101 f could also be a microphone. Sensor101 f could be a magnetic strip reader for credit cards and similarcards, or an antenna for either near-field RF communications, such as,but not limited to, reading an RF identity tag. An antenna for a sensor101 f could also collect longer-range RF signals, such as, but notlimited to, reading long-range radio frequency identity tags. Sensor 101f could also collect biometric data such as, but not limited to, heartrate, glucose levels, body temperature, or other health measurements fora user 113. The sensor 101 f can provide data to the CPU 101 b in theform of analog or digital data, which can be communicated via a systembus 101 d or physical interface 101 a and other electrical interfacesare possible as well. A sensor measurement can comprise the analog ordigital data collected by CPU 101 b from sensor 101 f.

A sensor measurement from sensor 101 f can include processing of theanalog or digital data input CPU 101 b by sensor 101 f, such as, but notlimited to, averaging over time, using mathematic formulas to convertthe raw data from sensor 101 f into a usable form. Module 101 may alsocollect sensor data or sensor values using a sensor 101 f and CPU 101 b,where the data or values are derived from electrical signals output by asensor 101 f. A sensor measurement can comprise the sensor data orsensor values. If module 101 comprises a “point of presence” paymentterminal, then a sensor measurement could comprise data read from apayment card. As contemplated herein, the terms “sensor measurement” and“sensor data” can be used interchangeably, and can also be consideredfunctionally equivalent. Although a single sensor 101 f is shown in FIG.1c , a module 101 could include multiple sensors. Each of the multiplesensors 101 f could include a sensor identity 151, which could comprisea number or string to identify the sensor 101 f. A sensor 101 f could beexternal to module 101, and also a plurality of sensors 101 f may beused and they also can connect to module 101 when module 101 uses radio101 z as a base station for a WiFi network.

Actuator 101 y could be a device to control a parameter or state for amonitored unit in M2M applications for module 101, such as, but notlimited to, changing a voltage or current, activating a switch or relay,turning on or off a microphone or speaker, activating or deactivating alight, and other examples are well known in the art. Actuator 101 ycould also be a speaker. Actuator 101 y could be controlled by module101 via a digital or analog output from CPU 101 b, which could also betransmitted or sent via system bus 101 d or a physical interface 101 a.Although actuator 101 y is illustrated as external to wireless module101 in FIG. 1c , actuator 101 y could also be internal to module 101,and module 101 could include multiple actuators 101 y. A module 101could include multiple actuators 101 y each with an actuator identity152. Sensors and actuators are well known to those of ordinary skill inthe art, and thus are not described in additional detail herein.

Module 101 can include a Universal Serial Bus (USB) interface 101 v. Inaccordance with an exemplary embodiment, module 101 can comprise awireless module and include a radio 101 z. Note that the use of a radio101 z is not required for module 101, which could also obtain aconnection to the IP Network 111 via a wired line such as Ethernet.Although not illustrated, radio 101 z could include antennas forreception and transmission of RF signals, and even multiple antennascould be used. Although a single radio 101 z is illustrated in module101, module 101 could also contain multiple radios 101 z. Radio 101 zcan support wireless LAN standards such as, but not limited to, WiFi,Bluetooth, and Zigbee, or similar wireless LAN standards. Note thatmodule 101 may also operate as a base station in a wireless LAN, suchas, but not limited to, an 802.11 base station. When module 101 operatesa wireless LAN, radio 101 z can function as either a client/node and/ora base station 103 to support communication from other wireless nodes inphysical proximity, such as, but not limited to, other nodes within anexemplary 50 meters. The other wireless nodes could comprise a sensor101 f and/or actuator 101 y, and in this case a sensor could be referredto as a “networked sensor” and an actuator could be referred to as a“networked actuator”.

In accordance with exemplary embodiments, module 101 can store moduleprivate key 112 a, MNO public key 502, and module identity 110, and asymmetric key 127 in memory/RAM 101 e during operation, such as when CPU101 b is active and the module 101 is connected to a network such as awireless network 102 during data transmissions. Module private key 112 apreferably is recorded in nonvolatile memory such as, but not limitedto, flash memory 101 w, so that module 101 has access to its private key112 a after the private key has been derived or loaded, including timeswhen a battery 101 k has been fully drained or removed from module 101(if module 101 does not utilize a persistent power source such asland-line power). Symmetric key 127 can be a secure, shared private keyfor use with symmetric encryption or symmetric ciphering algorithms 211(in FIG. 2c below). Symmetric key 127 may also include an expirationtime 133, such that symmetric key 127 may only be used by module 101and/or eUICC 107 during a limited period of time, such symmetric key 127remaining only valid for a day, or a week, or during a session (wherethe session comprises multiple messages and/or responses between amodule 101 and a wireless network 102), etc.

Module identity 110 is preferably a unique identifier of module 101, andcould comprise a number or string such as, but not limited to, a serialnumber, an international mobile subscriber identity number (IMSI),international mobile equipment identity (IMEI), or an Ethernet mediaaccess control (MAC) address. According to an exemplary embodiment,module identity 110 can also comprise a serial number or string that iswritten into hardware of module 101 upon manufacturing or distributionof module 101 (also depicted and described in connection with a step 511in FIG. 5b below). In this case, module identity 110 could be recordedin a read only memory 101 c, where read only memory 101 c could not beeasily erased or otherwise tampered with. Read only memory 101 c couldalso comprise a protected memory and the address for accessing themodule identity 101 within the ROM 101 c could comprise a protectedaddress.

A protected address can comprise an address accessible to a CPU 101 band readable by CPU 101 b where the data within the protected address isnot modified, changed, or updated by a CPU 101 b under normal operatingconditions. Also note that the protected address can comprise one formof a nonvolatile memory, where a memory records data. In exemplaryembodiments module identity 110 may preferably be permanently orpersistently associated with the physical hardware of module 101, whichcan be helpful for the security procedures contemplated herein. Moduleidentity 110 can function as a basic identifier for services from mobilenetwork operator 104, eUICC subscription manager 109, wireless network102, M2M service provider 115, or server 105 in order to properlyidentify module 101 among a plurality of modules. Module private key 112a and an associated module public key 112 b could be unique to module101 and uniquely associated with module identity 110, according to apreferred embodiment.

MNO public key 502 in module 101 could be obtained from downloading thekey over the IP Network 111, or optionally also written into nonvolatilememory of module 101 upon manufacture or distribution. MNO public key502 could be obtained using a domain name or Internet address that isrecorded in nonvolatile memory upon the configuration of module 101,such as, but not limited to, during installation or distribution, andmodule 101 could fetch the MNO public key 502 upon connecting to awireless network 102 or other connection to the IP Network 111.Additional elements besides those depicted in FIG. 1c could also berecorded in volatile memory 101 e, which could comprise a RAM 101 e. Forexample, cryptographic algorithms 141 could also be recorded in RAM 101e as well. Note that values and related data can also be recorded inboth RAM 101 e and nonvolatile memory 101 w at the same time, such thatdata in nonvolatile memory 101 w allows module 101 to access the dataafter a shutdown state, but moving the same data into RAM 101 e duringan active state allows module 101 to more quickly perform operationsusing a CPU 101 b. Other possibilities exist as well for the storagelocation of various values and data elements illustrated in FIG. 1cwithout departing from the scope of the present invention.

Module 101 may also contain cryptographic algorithms 141, which maycomprise a suite of algorithms or subroutines that can be utilized for(i) deriving a pair of keys comprising a public key and a private key,(ii) encrypting data using public keys, (iii) decrypting data usingprivate keys, (iv) processing secure hash signatures using private keys,and (v) verifying secure hash signatures using public keys, and relatedsoftware, firmware, or subroutines for implementing a cryptographicsystem, including symmetric ciphering algorithms. Cryptographicalgorithms 141 could utilize publicly available software librarieswithin tools such as, but not limited to, OpenSSL maintained by TheOpenSSL Project (http://www.openssl.org/), libgcrypt maintained by TheFree Software Foundation (http://www.gnu.org/software/libgcrypt/), andsimilar libraries such as, but not limited to, libmcrypt and Crypto++.Note that cryptographic algorithms 141 could also use proprietarycryptographic libraries as well. In addition to implementing asymmetricencryption/ciphering, such as, but not limited to, used with RSA and ECCcryptography, cryptographic algorithms 141 can provide symmetricciphering where a shared private key is utilized to both encrypt anddecrypt, such as, but not limited to, with the Advanced EncryptionStandard (AES) cipher suite.

As illustrated in FIG. 1c , module 101 may also contain a random numbergenerator 128. Random number generator 128 may contain a seed 128 b. Thecreation of random numbers with a high degree of entropy may beimportant the use of cryptographic algorithms 141. A plurality of thedata as a source for a random number seed 128 b could be appendedtogether into a “module random seed file” with a combined series or listof states (i.e. a plurality of sensor 101 f measurements, radio 101 zmeasurements, clock 160 times or values, memory 101 e or memory 101 wstates, operating system 101 h states, actuator 101 y states, and/orhardware 101 a or 101 d states). Note that values or data for each ofthe elements listed in the previous sentence could be utilized in a“module random seed file” instead of or in addition to a state. The useof a “module random seed file” with a random number generator 128 isalso depicted and described in connection with FIG. 1d of U.S. patentapplication Ser. No. 14/084,141, filed Nov. 19, 2013 in the name of JohnNix, which is hereby incorporated by reference in its entirety.

FIG. 1d

FIG. 1d is a graphical illustration of hardware, firmware, and softwarecomponents for a server, in accordance with exemplary embodiments. Theillustrated components for the server 105 in FIG. 1d include a centralprocessing unit (CPU) 105 b, a random access memory (RAM) 105 e, asystem bus 105 d, storage 105 m, an operating system 105 h, and a modulecontroller 105 x. These elements can provide functions equivalent to thecentral processing unit (CPU) 101 b, RAM 101 e, system bus 101 d, flashmemory 101 w, and an operating system 101 h described above in FIG. 1b ,respectively. In general, a server 105 can have higher-end componentssuch as, but not limited to, a larger CPU 105 b and greater RAM 105 e inorder to support communications with a plurality of modules 101. Server105 can comprise a general purpose computer such as, but not limited to,a rack mounted server within a data center or rack, or could alsocomprise a desktop computer or laptop. Server 105 could also be aspecialized computer, with hardware and software selected for supportinga plurality of modules 101 connecting and communicating simultaneously.Operating system 101 h can comprise an operating system appropriate fora server such as, but not limited to, Linux, Solaris®, or Windows®Server. Server 105 can preferably include at least one wired Ethernetconnection with high bandwidth that is persistently connected to the IPNetwork 107, while the IP Network 107 connection for module 101 may betransient as module 101 changes between sleep and active states. Modulecontroller 105 x can provide the server-side logic for managingcommunications and controlling module 101 using a module database 105 k.Although not depicted in FIG. 1d , a network controller can providefunctionality for communicating with external servers or nodes, such as,but not limited to, a wireless network 102 illustrated in FIG. 1 a.

A module controller 105 x may be applications programmed in a languagesuch as, but not limited to, C, C++, Java, or Python and could providefunctionality to support authentication and communication with modules101, including M2M applications such as, but not limited to, remotemonitoring of sensors and remote activation of actuators. Modulecontroller 105 x could also be software routines, subroutines, linkedlibraries, or software modules, according to preferred embodiments. Manyof the logical steps for operation of server 105 and module controller105 x can be performed in software and hardware by various combinationsof physical interface 105 a, system bus 105 d, device driver 105 g, andoperating system 105 h.

A module controller 105 x can also access a set of cryptographicalgorithms (equivalent to the cryptographic algorithms 141 for a module101 in FIG. 1c above) in order (i) to encrypt and decrypt data, and also(ii) process or generate a digital signature and verify received digitalsignatures, including message digest authentication. When server 105 isdescribed herein as performing various actions such as, but not limitedto, acquiring an IP address, monitoring a port, transmitting or sendinga packet, receiving a message, or encrypting or signing a message,specifying herein that server 105 performs an action can refer tosoftware, hardware, and/or firmware operating within server 105performing the action. As contemplated herein, when a server 105 isdescribed as performing an action such as, but not limited to, sending aresponse, receiving a message, verifying a digital signature, decryptingdata, etc., in some embodiments a set of servers 710 (illustrated inFIG. 7) can perform the actions for the server 105. In this case, aserver 105 could be a member of the set of servers 710.

The server 105 may store computer executable instructions such as, butnot limited to, module controller 105 x or network controller 105 i onstorage 105 m. Storage 105 m may comprise a disk drive, a solid-statedrive, an optical drive, or a disk array. Module controller 105 x (i)can manage communications with module 101 or a plurality of modules 101and (ii) may be downloaded and installed on the server 105. As notedpreviously and elsewhere herein, module program 101 i and modulecontroller 105 x can preferably interoperate with each other in order tocollect sensor data and control an actuator associated with a monitoredunit 119.

The module controller 105 x operating within server 105 illustrated inFIG. 1d can provide computer executable instructions to hardware such asCPU 105 b through a system bus 105 d in order to (i) receive a messagefrom the module 101 and (ii) send a response, wherein the message caninclude sensor 101 f data and the response can include anacknowledgement of the message and/or an instruction to the module 101.The module controller 105 x can enable the server 105 to send a responseto a message from module 101 by recording data associated with module101 in memory such as RAM 105 e, where the data can include aninstruction from module 101, a destination IP:port number, a packet orpacket header value, and the data can be processed using an encryptionor ciphering algorithm or key, a digital signature algorithm or key,etc. The operating system 105 h or the device driver 105 g can write thedata from RAM 105 e to a physical interface 105 a using a system bus 105d and an Ethernet connection in order to send the data via the IPNetwork 107 illustrated in FIG. 1a . Alternatively, the modulecontroller 105 x can write the data directly to the physical interface105 a using the system bus 105 d.

The server 105 can utilize the physical interface 105 a to receive datafrom a module 101 and/or wireless network 102 using a local area networksuch as Ethernet, although the physical interface 105 a of server 105could also utilize a wireless connection. The server 105 can listen ormonitor for data from the IP Network 107 using port number and/or aTCP/UDP socket. The received data from a module 101 can be a messageformatted according to an Internet packet or datagram or series ofdatagrams inside Ethernet packets and include information from a module101 such as, but not limited to, a source IP address and port number, anidentity of the module, sensor data that may be encrypted, and/or adigital signature of the module. The received data from wireless network102 can comprise a series of datagrams formatted according to InternetProtocol and/or datagrams inside Ethernet packets. The received data ormessage from wireless network 102 can include information regardingwireless network 102 and/or server 105, such as a source IP address andport number associated with wireless network 102, an identity of theserver, actuator instructions or commands for a module 101 that may beencrypted, and a digital signature associated with the wireless network102.

When server 105 receives messages or data, the operating system 105 h ordevice driver 105 g can record the received data from module 101 orwireless network 102 via physical interface 105 a into memory such asRAM 105 e. The module controller 105 x or operating system 105 h maysubsequently access the memory in order to process the data received.The network controller 105 i and/or module controller 105 x, oroperating system 105 h can include steps to process the data recorded inmemory and received from the module 101 or wireless network 102, suchas, but not limited to, parsing the received packet, decrypting data,verifying a digital signature with a key, or decoding sensor dataincluded in a message from the module.

The server 105 and/or module controller 105 x may communicate withwireless network 102 by sending and receiving packets over a LAN or theIP Network 107, using a physical interface 105 a and a wired connectionsuch as Ethernet or possibly a wireless connection as well. The server105 can use the physical interface 105 a such as an Ethernet connectionto send and receive the data from the IP Network 107. For those skilledin the art, other steps are possible as well for an module controller105 x or operating system 105 h within a server 105 to (i) send/receivea packet or message to/from a module 101 and (ii) send/receive a packetor message to/from an wireless network 102 without departing from thescope of the present invention. Module controller 105 x may optionallybe combined within a server 105, or alternatively distributed acrossdifferent physical computers and function in a coordinated manner usinga network.

The device drivers 105 g, operating systems 105 h, and/or modulecontroller 105 x could also optionally be combined into an integratedsystem for providing the server 105 functionality. Although a singlephysical interface 105 a, device-driver set 105 g, operating system 105h, and module controller 105 x are illustrated in FIG. 1d for server105, server 105 may contain multiple physical interfaces, devicedrivers, operating systems, software programs, module programs, and/oruser interfaces. Server 105 may operate in a distributed environment,such that multiple computers operate in conjunction through a network toprovide the functionality of server 105. Also, server 105 may operate ina “virtualized” environment, where server 105 shares physical resourcessuch as a physical CPU 105 b with other processes operating on the samecomputer. And other arrangements could be used as well, withoutdeparting from the invention.

FIG. 1e

FIG. 1e is a graphical illustration of an exemplary system that includesa module, a mobile network operator, and an eUICC in accordance withexemplary embodiments. System 199 in FIG. 1e can include a mobilenetwork operator 104 and a module 101. The mobile network operator 104can communicate with the module 101 using either (i) a wireless network102 (where the wireless network 102 is associated with the MNO 104), or(ii) an IP network 111, where the IP network could comprise the globallyroutable public Internet or a private network. The wireless network 102could comprise the radio access portion of the mobile network operator104, such as a collection of base stations 103 using licensed radiospectrum such as, but not limited to, the 700 Mhz band for LTE, andother possibilities exist as well for the wireless network 102. Ascontemplated herein a network can comprise either a mobile operatornetwork 104 or a subset of the mobile operator network 104. The mobilenetwork operator 104 and/or a network could comprise a collection ofservers such as the, but not limited to, the collection of servers 105illustrated in FIG. 1e , where the collection or set of servers operatein a coordinated manner in order to provide services such as Internetaccess and/or telephone calls to a plurality of modules 101 (where themodules 101 could be both M2M devices and regular mobile phones forsubscribers).

The mobile network operator 104 can include a server A 105 aa, server B105 bb, and server C 105 cc. Server A 105 aa can generate both (i)network access credentials in the form of a network module identity andkey K, and (ii) authentication vectors 117. The authentication vector117 can include data such as RAND 118, RES 119, a network authenticationtoken (AUTN) and a sequence number, where server A 105 aa processes datafor the authentication vector 117 using the network access credentials.Server A 105 aa could comprise a home subscriber server (HSS) for a 4GLTE or 4G LTE advanced network, or an authentication center (AuC) for 2Gor 3G networks. Server A 105 aa could be associated with an IP address106 aa and communicate with other servers using the IP address.

Server B 105 bb can include an IP address 106 bb and (i) receiveauthentication vectors 117 from the server A 105 aa, and (ii)communicate with modules 101 using the wireless network in order toauthenticate the modules using the authentication vectors 117. Server B105 bb could comprise a mobility management entity (MME) for a 4G LTE or4G LTE advanced network, or equivalent functionality to receiveauthentication requests from modules 101 with other wireless wide-areanetworking technology. The MME can support radio beareractivation/deactivation processes for the module 101 and authenticatingthe module 101 by recording an authentication vector 117, where theauthentication vector 117 can be received from an HSS. Server C 105 ccwith IP address 106 cc can communicate application layer data withmodule 101, such as handling voice call requests. Server C 105 cc couldcomprise a server to support protocols for an IP multimedia subsystem(IMS), such as, but not limited to, a session initiation protocol (SIP)application server. As illustrated in FIG. 1e , a server C 105 cc couldreceive a SIP Invite 151 message from a network application 101 x inmodule 101, and send a SIP response such as, but not limited to, a SIPTrying 152 message. The network application 101 x for module 101 couldutilize a different IP address 106 b than the eUICC 107. Thus, a firstserver C 105 cc for a MNO 104 could receive data from module 101 with afirst source IP address 106 b, while, during the same session, a secondserver B 105 bb could receive data (such as the RES 119 illustrated)from a second IP address 106 c.

Each of the servers 105 aa, 105 bb, and 105 cc can comprise a server asdepicted and described in connection with server 105 in FIG. 1d aboveand FIG. 1m of U.S. patent application Ser. No. 14/084,141, filed Nov.19, 2013 in the name of John Nix, which is hereby incorporated byreference in its entirety. The IP address 106 bb (and IP address 106 aaand 106 cc) can include a subnet prefix 106 d and an interfaceidentifier 106 e. The IP address 106 bb can comprise an IPv6 address,where the subnet prefix 106 d comprises the first 64 bits of a 128 bitIPv6 address, and the interface identifier 106 e can comprise the last64 bits of a 128 bit IPv6 address as shown in FIG. 1e . Other nodesconnected to the wireless network 102 can also include IPv6 addresseswith different values for the subnet prefix 106 d and the interfaceidentifier 106 e. A module 101 can include both a network application101 x and an eUICC 107, where a network application 101 x is depictedand described in connection with FIG. 1b and an eUICC 107 is depictedand described in connection with FIG. 1a , FIG. 1b and FIG. 1 c.

In an exemplary embodiment, different elements within module 101 can beassociated with different IP addresses. The network application 101 xcan be associated with an IP address 106 b and the eUICC 107 can beassociated with an IP address 106 c. The wireless network 102 couldassign the module 101 the subnet prefix 106 d used by module 101 withwireless network 102, and an operating system 101 h could assign theinterface identifier 106 e used by the network application 101 x and theeUICC 107. Other possibilities exist as well for the source of IPaddresses in a system 199, but an end result can comprise the eUICC 107having a unique IPv6 address 106 c such that a server 105 such as an MMEcan communicate with the eUICC 107 directly by sending a packet with aRAND 118 value from server 105 address 106 a to eUICC 107 address 106 c.

Although not illustrated in FIG. 1e , the exemplary IP addresses forserver 105 and eUICC 107 can be associated with port numbers, such thatserver 105 can use a first port number with the IP address 106 a whensending a RAND 118, and eUICC 107 could use a second port number withthe IP address 106 c when receiving the RAND 118. Server 105 can use athird port number when receiving a RES 119, and eUICC 107 could use afourth port number when sending the RES 119. The first and third portnumbers could be the same value or number, and the second and fourthport numbers could be the same value or number. In an exemplaryembodiment, the RAND 118 and RES 119 in system 199 can be formattedaccording to the UDP Lite protocol, as specified in IETF RFC 3828, whichis also incorporated by reference herein. The term “UDP Lite” describedin the present invention may also refer to any connectionless protocolsupported on IP Network 111 and wireless network 102 where checksums maybe partially disabled, thereby supporting the transfer of bit errorswithin a datagram.

As illustrated in FIG. 1e , an eUICC 107 operating in module 101 couldbe an application with a unique IPv6 address 106 c, and the networkapplication 101 x utilize a different IPv6 address 106 b. The two IPaddresses could be on the same subnet 106 d used by a module 101, andthe network application 101 x could communicate with the eUICC 107locally within module 101 using the two different IPv6 addresses 106 band 106 c. The network application 101 x could communicate with theeUICC 107 locally for exemplary “other data” depicted in FIG. 1e , whichcould comprise the storing of an address book in the eUICC 107, readinga set of network parameters by the network application 101 x from theeUICC 107 with the eUICC profile 107 d, etc. In an exemplary embodiment,the eUICC 107 could communicate with the mobile network operator 104 forauthentication, thus potentially bypassing the network application 101 xfor separate handling of RAND 118 and RES 119 values depicted in FIG. 1e. The authentication messages comprising a RAND 118 and a RES 119 couldbe communicated between the eUICC 107 with IP address 106 c to themobile network operator 104 with IP address 106 a without the use of anetwork application 101 x.

The eUICC 107, with an associated IP address 106 c could alsocommunicate with the eUICC subscription manager 109 by sending a packetfrom IP address 106 c to an IP address of a server associated with theeUICC subscription manager, such as the exemplary data for a step 205depicted and described in connection with FIG. 2a and FIG. 3 below. Notethat the eUICC 107 with the IP address 106 c can communicate with theeUICC subscription manager 109 without the wireless network 102, butrather through an IP network 111. The connectivity for the IP network111 could be provided by a different wireless network 102 than thewireless network 102 associated with the MNO 104. Although the use of aspecific, unique IP address 106 c for eUICC 107 is illustrated in FIG.1e , an eUICC 107 does not require a separate IP address 106 c in otherembodiments, and the eUICC 107 could share an IP address 106 b with anetwork application 101 x or other processes or elements within module101.

System 199 in FIG. 1e illustrates exemplary benefits for a MNO 104 andmodule 101 of using an eUICC 107 as contemplated herein. Module 101 mayconnect with MNO 104 both through wireless network 102 (such as whenmodule 101 communicates through a base station 103 operated by MNO 104)and also through the IP network 111. For example, module 101 may movephysically between locations, and module 101 could communicate with MNO104 from locations that are not served by base stations 103 associatedwith MNO 104. However, module 101 could obtain access to an IP network111 through other means, such as via a WiFi hotspot, white spacespectrum, or possibly through a different wireless network 102 operatedby another MNO 104 than the MNO 104 associated with a profile 107 d forthe eUICC 107. The module 101 and MNO 104 could take the authenticationsteps shown in FIG. 1e of server B 105 bb sending a RAND 118 to themodule 101 through the IP network 111 in order for module 101 to processa RES 119. Although not illustrated in FIG. 1e , module 101 could send anetwork module identity such as the first network module identity 202 toserver B 105 bb through the IP network 111 before server B 105 bb sendsthe RAND 118.

In exemplary embodiments, module 101 could authenticate with MNO 104even when module 101 is not attached to wireless network 102 associatedwith MNO 104. Note that module 101 using an IP address 106 c to send RES119 is different from conventional technology for an eUICC, since theeUICC 107 would not normally be associated with an IP address 106 cwithout first successfully authenticating with MNO 104. In other words,module 101 with eUICC 107 could use connectivity to the IP network 111from a network not controlled by MNO 104 in order to authenticate withMNO 104. In this manner, a MNO 104 can use an eUICC 107 to securelyauthenticate the module 101 and subsequently communicate with the module101 even when module 101 is not on a network operated by MNO 104. In anembodiment illustrated in FIG. 1e , MNO 104 could provide voice servicesto module 101 through the IP network 111 (such as the SIP messages 151and 152), using the eUICC 107 when module 101 obtains IP connectivitythrough a different network. By authenticating with MNO 104 through IPnetwork 111 (where IP network 111 is not controlled by MNO 104), MNO 104could send module 101 a new set of network parameters 201, an eUICCprofile 107 c, and other data related to connecting with MNO 104.Authenticating with MNO 104 through IP network 111 (where IP network 111is not controlled by MNO 104) can support secure communication over apublic network, such as ciphering application data using theauthentication tokens of RAND. Other possibilities exist as well withoutdeparting from the scope of the present invention.

FIG. 2a

FIG. 2a is a graphical illustration of an exemplary profile for aneUICC, including encrypted data, decryption steps, and decrypted datafor the profile, in accordance with exemplary embodiments. Two exemplaryforms of an eUICC profile are illustrated in FIG. 2a : an encryptedeUICC profile 107 c and an eUICC profile 107 d. As contemplated herein,an eUICC profile, such as the exemplary eUICC profile 107 c and 107 d,can be similar to profiles for an eUICC contemplated in ETSIspecification TS 103 383 v12.2.0 and related standards, but withdifferences to the currently published standards, as described below. AneUICC profile 107 d can comprise the data from an encrypted eUICCprofile 107 c, where (i) a first portion of the data, comprisingciphertext 208 a, has been decrypted, and (ii) a second portion of theencrypted eUICC profile 107 c, comprising ciphertext 208 b remainsencrypted. Thus, an encrypted eUICC profile 107 c can include a firstportion, or ciphertext 208 a and a second portion, or ciphertext 208 bas depicted in FIG. 2a . As contemplated herein, an encrypted eUICCprofile 107 c can be referred to as “profile 107 c”, and the eUICCprofile 107 d can be referred to as “profile 107 d”. Both profile 107 cand profile 107 d can include a profile identity 107 e. Profile identity107 e can comprise a number or string such that various elementsillustrated in FIG. 1a can properly refer to, select, and or identity aprofile 107 c or profile 107 d, including elements such as a mobilenetwork operator 104, eUICC subscription manager 109, module 101, and/oran eUICC 107.

A profile 107 c or profile 107 d in exemplary systems herein, includingsystems 100, 300, and 500 can comprise several different possibleembodiments. The profiles could be recorded in a file or data set, andstored in nonvolatile memory associated with an eUICC 107, such as, butnot limited to, a flash memory 101 w. As transferred across a wirelessnetwork 102 and/or IP network 111, the encrypted eUICC profile 107 c canbe segmented into separate datagrams and transferred using a transportlayer protocol such as TCP. An application layer protocol such astransport layer security (TLS) and additional ciphering at the data-linklayer could be utilized as well, in addition to sending and receivingthe data for a profile 107 c as ciphertext 208 a and 208 b. Theexemplary forms for a profile 107 c and 107 d in FIG. 2a can representdata for a file recorded in a module, such as, but not limited to, (i)storing in a volatile memory 101 e when the profiles 107 c or 107 d arebeing processed or accessed by a CPU 101 b, or (ii) storing in annonvolatile memory such as flash memory 101 w when the profile 107 c and107 d are stored long term, including times when a battery 101 k may beremoved from module 101.

Note that profile 107 c with at least two distinct portions, comprisingciphertext 208 a and ciphertext 208 b, could be recorded in separatesegments or in distinct location within module 101 or with an eUICCsubscription manager 109, and the two or multiple portions together cancomprise a profile 107 c. In other words, the portions of ciphertext 208a and 208 b (and other data in a profile 107 c or profile 107 d) can berecorded in different locations while comprising a profile 107 c. Otherpossibilities exist as well for the structure and recording of theexemplary data for a profile 107 c and 107 d without departing from thescope of the present invention. Although the label “Storedw/Subscription Manager 109” is depicted with an encrypted eUICC profile107 c, the encrypted eUICC profile 107 c can also be stored as theformat depicted in FIG. 2a within a module 101 or an eUICC 107, until atleast a step 206 is performed to decrypt the first ciphertext 208 a, asdescribed in this FIG. 2a and FIG. 3 below.

A first portion of profile 107 c can include ciphertext 208 a, whereciphertext 208 a can include a set of network parameters 201, a firstnetwork module identity 202, and a first key K 203. Ciphertext 208 a caninclude these elements in a ciphered string or file, such that a thirdparty would not feasibly be able to ready the plaintext withinciphertext 208 a without a key such as eUICC profile key 107 b.Ciphertext 208 a can comprise the set of network parameters 201, thefirst network module identity 202, and the first key K 203 as plaintextciphered with a eUICC profile key 107 b, as depicted and described inconnection with FIG. 2b below. The set of network parameters 201 couldcomprise a list of values and settings for a module 101 to utilize inconnecting with a mobile network operator 104. The set of networkparameters 201 could include a list of numbers or strings for valuessuch as (i) allowed frequencies or frequency bands to scan, (ii)preferred access lists for roaming onto other wireless networks, (iii)criteria for a module 101 to select base stations 103 in idle mode, (iv)support for emergency services, (v) supported languages or characterencoding, (vi) codes to search for in beacons broadcast by a wirelessnetwork 102, (vii) parameters for a radio 101 z to use when connectingto a wireless network 102, (viii) names or addresses for a server 105associated with a MNO 104 in order for a module 101 to send data, etc.

A first network module identity 202 within a ciphertext 208 a in profile107 c can comprise a subscriber identity or related identifier of module101 when connected to a MNO 104 through a wireless network 102. In anexemplary embodiment, the first network module identity 202 can comprisean international mobile subscriber identity (IMSI), a globally uniquetemporary identity (GTUI), a media access control (MAC) address, atemporary mobile subscriber identity (TMSI) or a similar number orstring to identify a module 101 with wireless network 102. Note that anetwork module identity such as the first network module identity 202can be different than a module identity 110, such that a network moduleidentity can be assigned by a mobile network operator 104, while amodule identity 110 can be assigned by manufacturer. In other words, anetwork module identity such as the first network module identity 202can change over time for a module 101, while the module identity 110 canremain the same. The eUICC identity 107 a can also remain the same valueor number while a network module identity changes.

A first key K 203 within a ciphertext 208 a in profile 107 c cancomprise a standards-based shared secret key K for use in wireless WANnetworks based on ETSI, 3GPP, and related standards. As currentlyspecified in ETSI/3GPP standards for LTE and LTE Advanced networks, theshared secret key K, (i) recorded in a SIM or UICC, and a MNO 104 HSS,and (ii) described in 3GPP TS 33.401 V12.9.0 and related standards,comprises a pseudo-random number with a length of 128 bits. The lengthof key K for standards-based wireless networks 102 may be extended inthe future. The use of shared secret key K for authentication of amodule 101, and also for ciphering and data integrity, with a wirelessnetwork 102 that implements ETSI and/or 3GPP standards is also definedin the specifications ETSI TS 135 205-209 and related standards. Boththe first key K 203 and the second key K 204 can comprise a sharedsecret key K as described in 3GPP TS 33.401 V12.9.0 FIGS. 6.2-1 andrelated standards. A mobile network operator 104 using the function ofan authentication center, possibly within a home subscriber server (HSS)can generate or process authentication vectors 117 comprising an randomnumber (RAND), an authentication token (AUTN), a response (RES), and asequence number using the first key K 203 recorded in a eUCC profile 107c or 107 d for the first network module identity 202. Likewise,authentication vectors 117 can be generated by a HSS and sent to a MMEfor the second network module identity 209 a with the second key K 204.

In exemplary embodiments, the first key K 203 depicted in FIG. 2a isalso depicted and described as operating as a standards-based sharedsecret key K in FIG. 3 below at a step 306. Using the properties of astandards-based key K, a module 101 or an eUICC 107 can use the firstkey K 203 and a first random number RAND 118 received to process orcalculate a first response RES 119. Step 306 with a first key K 203 cancomprise an authentication for a module 101 (comprising a “mobilephone”, “mobile station”, or “user equipment”) within standards such as3GPP TS 33.401 V12.9.0 and related standards using a shared secret keyK. As contemplated herein, the use of the term “random number” cancomprise a pseudo-random number with a high degree of informationentropy that may not be purely mathematically random, but can beconsidered a random number and referred to as a random number for thepurposes herein.

In an exemplary embodiment, as described in FIG. 2e and step 302 a ofFIG. 3 below, the first key K 203 can be optionally recorded inciphertext 208 a with an additional layer of encryption, such that thefirst key K 203 is recorded as a ciphertext 208 c within ciphertext 208a. In other words, upon conversion of ciphertext 208 a into plaintextusing a profile deciphering algorithm 206, the first key K 203 canretain an additional layer of encryption as ciphertext 208 c with otherdata in a profile 107 d that may be plaintext. This optional additionallayer of encryption for the first key K 203 is also depicted within theprofile 107 d, where ciphertext 208 c optionally remains in profile 107d after the conversion of ciphertext 208 a into plaintext using a step206. As described below, the optionally additional layer of encryptionfor ciphertext 208 c with the first key K 203 can be (i) processed intoplaintext first key K 203 (ii) after a subsequent deciphering with anasymmetric ciphering algorithm 219 as illustrated in FIG. 2 e.

Note that the additional layer of encryption for the first key K 203, inthe form of using a ciphertext 208 c, can be optionally omitted and thefirst key K 203 could be plaintext after the conversion of the firstportion of profile 107 c as ciphertext 208 a into plaintext in a profile107 d using a step 206. Thus, the dashed lines around the first key K203 as a ciphertext 208 c indicate the use of ciphertext 208 c isoptional, depending on the security requirements for an MNO 104 whendistributing electronically the first key K 203. In another embodimentas described in FIG. 3, the first key K 203 can comprise a null value,such as the value for a key K in order to support emergency services ifmodule 101 has no valid UICC, and in this case the use of additionalencryption via ciphertext 208 c can be omitted for a first key K 203. Ina related embodiment, the first key K 203 can be omitted entirely from aprofile 107 c and profile 107 d, and the eUICC 107 can subsequently usea null value for the first key K 203.

A second portion of profile 107 c can include ciphertext 208 b, whereciphertext 208 b can include a second key K 204 a and a second networkmodule identity 209 a. Ciphertext 208 b can be ciphered with a symmetrickey 127, where the ciphering and deciphering of a portion of ciphertext208 b is depicted and described in connection with FIG. 2c below. In anexemplary embodiment, the second network module identity 209 a cancomprise an international mobile subscriber identity (IMSI), a globallyunique temporary identity (GTUI), a media access control (MAC) address,or similar number or string to identify a module 101. In exemplaryembodiments, the second network module identity 209 a can be a differentnumber or value than the first network module identity 202. Although thesecond network module identity 209 a is illustrated in FIG. 2a asinternal to ciphertext 208 b, the second module identity 209 a could beexternal to ciphertext 208 b, such as, but not limited to, the secondnetwork module identity 209 a being within a profile 107 c or profile107 d and external to ciphertext 208 b. In other words, in exemplaryembodiments, the second network module identity 209 a may optionally notbe ciphered with the symmetric key 127, while the second key K 204 a canbe ciphered with the symmetric key 127. As contemplated herein, the termsecond network identity 209 a comprises an encrypted second networkidentity 209 a, where the second network identity 209 is the plaintextversion of the encrypted second network identity 209 a. Likewise, theterm second key K 204 a comprises an encrypted second key K 204 a, wherethe second key K 204 is the plaintext version of the encrypted secondkey K 204 a.

In another exemplary embodiment, the second network module identity 209can comprise the same number or value as the first network moduleidentity 202, or the second network module identity 209 can beoptionally omitted. In this case, if (A) the second network moduleidentity 209 comprises the same number or value as the first networkmodule identity 202, or the second network module identity 209 isoptionally omitted, then (B) the mobile network operator 104 canpreferably support the use of two different shared secret keys K (i.e.first key K 203 and second key K 204) for the same network moduleidentity 202. However, given the current functionality of an HSS andrelated infrastructure for wireless networks 102, the use of twodifferent network module identities (i.e. the first network moduleidentity 202 and the second network module identity 209) with twodifferent shared secret keys K (i.e. first key K 203 and second key K204, respectively) may be more compatible or suitable for deployed andoperational HSS infrastructure.

A second key K 204 a (as an encrypted form of plaintext second key K204) within a ciphertext 208 b in profile 107 c can comprise astandards-based shared secret key K for use in wireless WAN networksbased on ETSI, 3GPP, and related standards. The use of a second key K204 a (in an unencrypted form of second key K 204) can be equivalent toa first key k 203, but comprise a different random number. The secondkey K 204 can comprise a random number that is 128 bits in length inorder to support 4G networks such as LTE that are widely deployed in2013, although the length of either first key K 203 or second key K 204may be a longer number in the future, such an exemplary 256 bits andother possibilities exist as well for the key length. A second key K 204can also be used with standards-based authentication with a wirelessnetwork 102, where the second key K 204 in FIG. 2a is also depicted anddescribed as operating as a standards-based shared secret key K in FIG.3 below at a step 311.

The list of exemplary data for encrypted eUICC profile 107 c and aneUICC profile 107 d comprises an exemplary set, and the profiles couldalso include additional data to the exemplary data illustrated in FIG.2a . The additional data for a profile 107 c or 107 d could include (i)a set of cryptographic parameters for eUICC 107, (ii) a set ofcryptographic algorithms, such as the exemplary cryptographic algorithmsdescribed within ETSI TS 135 205-209 and related standards, (iii) a nameor address for an eUICC subscription manager 109 associated with theprofile 107 c, (iv) a name or address for a server 105 associated with amobile network operator 104, (v) a digital signature of the profile 107d processed with a private key from either eUICC subscription manager109 or MNO 104, (vi) a date or timestamp for processing the profile 107c or 107 d, (vii) and similar or related values for a module 101 and/oreUICC 107 to utilize the profiles. This exemplary additional data whichis not depicted in FIG. 2a could be included within or external to anyof ciphertext 208 a and ciphertext 208 b.

Note that the profile identity 107 e may preferably be external tociphertext 208 a and ciphertext 208 b, in order that module 101 and/oreUICC 107 can take steps to identify a profile 107 c or 107 d. Inaddition, although a single profile 107 c and profile 107 d areillustrated in FIG. 2a , a module 101 and/or an eUICC 107 could includea plurality of profiles 107 c and/or 107 d, where each of the pluralityof profiles could comprise different data associated with differentwireless networks 102. In an exemplary embodiment, more than one profile107 c or profile 107 d could be associated with the same wirelessnetwork 102, such that a mobile network operator 104 can prefer for thesame module 101 to utilize different network access credentials overtime, such that the same module 101 could use a different key K and adifferent network module identity with the same wireless network 102 ormobile network operator 104 over time. Different profiles 107 c or 107 dcan also be identified by the use of a different profile identity 107 e.Each profile 107 c can be associated with an eUICC profile key 107 b asan encryption key (shown in FIG. 2b below), although multiple profiles107 c could also share the same eUICC profile key 107 b.

A module 101 can receive a profile 107 c using a step 205. A profile 107c can be recorded with an eUICC subscription manager 109 before beingreceived by a module 101. As depicted in FIG. 2a , a module 101 canreceive the profile 107 c at a step 205 using the IP network 111. Theuse of a step 205 by a module 101 is depicted and described inconnection with FIG. 3 below. The module 101 can receive the profile 107c using a network that is different than wireless network 102 associatedwith the network access credentials comprising the first key K 203 andthe first network module identity 202. In an exemplary embodiment,module 101 can receive the profile 107 c in a step 205 using an initialwireless network 102, where module 101 connects with and authenticateswith the initial wireless network 102 using an initial eUICC profile 107d different than the eUICC profile 107 d depicted in FIG. 2a . Or,module 101 could receive a profile 107 c using a wireless LAN network ora wired connection via a physical interface 101 a such as a USBinterface 101 v. In another exemplary embodiment, module 101 can receivethe profile 107 c from a manufacturer, distributor, end user, ortechnician taking steps to load the profile 107 c into a nonvolatilememory within module 101 or eUICC 107. Upon receipt of a profile 107 cby module 101, the module 101 can record or store the profile 107 c withan eUICC 107.

A module 101 can use an eUICC 107 to decrypt the first portion orciphertext 208 a in a profile 107 c using a step 206. Before a step 206,a module 101 can receive an eUICC profile key 107 b, where the eUICCprofile key 107 b can comprise a symmetric ciphering key. The use of astep 206 by module 101 and/or eUICC 107 is also depicted and describedin connection with FIG. 2b and FIG. 3 below. Note that both eUICCsubscription manager 109 and module 101 can record profile 107 c withciphertext 208 a for a period of time, and the step 206 can be taken (i)after receiving eUICC profile key 107 b and (ii) before module 101authenticates with a wireless network 102 using the eUICC profile 107 c.A step 206 can covert the ciphertext 208 a into plaintext, such that aneUICC 107 can read the values in order to authenticate with a wirelessnetwork 102 using the first key K 203. By encrypting the first networkmodule identity 202 and the first key K 203, these network accesscredentials can remain secure, such that a profile 107 c can betransferred in normal physical media (such as disks, drives, or filestransferred electronically) or in communications channels outside thecontrol of a mobile network operator 104 and/or eUICC subscriptionmanager 109.

As depicted in FIG. 2a , after a step 206 to convert profile 107 c intoprofile 107 d, where the ciphertext 208 a is decrypted using the eUICCprofile key 107 b, the ciphertext 208 b with the second key K 204 a canremain encrypted and thus the second key K can continue to remain securewithin a profile 107 d. In addition, although ciphertext 208 b isdepicted in a profile 107 c as external to, or separate from, ciphertext208 a, ciphertext 208 b could optionally be included within ciphertext208 a. In this case, where ciphertext 208 b is within ciphertext 208 afor a profile 107 c, the result of a step 206 to generate a profile 107d can remain the same, where the ciphertext 208 a can be decrypted bystep 206 and ciphertext 208 b remains encrypted in the resulting profile107 d from a step 206.

A module 101 can use an eUICC 107 to decrypt the second portion orciphertext 208 b in a profile 107 d using a step 207. Before a step 207,a module 101 can take the previous steps 205 and 206 in order to recorda profile 107 d with an eUICC 107. Before a step 207, module 101 canreceive a symmetric key 127, where the symmetric key 127 can comprise asymmetric ciphering key. In exemplary embodiments, module 101 canreceive the symmetric key 127 from a mobile network operator 104 after auser associated with module 101 performs a separate authentication step308 b as depicted and described in connection with FIG. 3 and FIG. 4below. By a mobile network operator 104 only sending symmetric key 127after the second authentication step 308 b, the second key K 204 canremain secured, while a user is allowed to access the wireless network102 (perhaps temporarily or with other constraints such as limitingaccess to the Internet but allowing emergency calls) using the first keyK 203.

In this manner and by using a second, separate authentication step 308 bbefore sending symmetric key 127, the decryption of network accesscredentials such as the second key K 204 can remain in the control of amobile network operator 104, thereby increasing the security ofexemplary systems illustrated herein, such as systems 100, 300, and 500.By ciphering the second key K 204 with symmetric key 127, security overconventional technology for an eUICC can be increased for both a userand a mobile network operator. With conventional technology for aneUICC, where only the first key K 203 is used for authentication andciphering of data between module 101 and wireless network 102, thedecryption of the first key K 203 can be outside the control of a mobilenetwork operator 104. With conventional technology contemplated for aneUICC, an end user outside the control or a contractual relationshipwith mobile network operator 104, including possibly fraudulent users orimposters of valid users, could (i) take steps to obtain a plaintextfirst key K 203 and associated plaintext first network module identity202 and (ii) use the credentials to fraudulently access the wirelessnetwork 102. In contrast and as contemplated herein, the symmetric key127 to decrypt the second key K 204 a can preferably be only madeavailable to users who authenticate with mobile network operator using astep 308 b as described below (or an equivalent step or relatedcommercial arrangements between a user and a mobile network operator104).

In exemplary embodiments, use of two sets of network access credentialscomprising at least the first key K 203 and the second key K 204 allowsa user with an eUICC profile 107 c to connect to the wireless network102 using the first key K 203, such that the module 101 can haveconnectivity to the mobile network operator 104 via the wireless network102 (and also IP network 111) in order to conduct separateauthentication steps 308 b. The security steps for a mobile networkoperator 104 to control the decryption of the first key K 203 can belowered (thus making the distribution of profile 107 c simpler, lesscostly, and less complex), while a mobile network operator 104 canretain full control over the decryption of the second key K 204 a into ausable second key K 204 associated with the second network moduleidentity 209.

The use of a step 207 by module 101 with an eUICC is also depicted anddescribed in connection with FIG. 2c and FIG. 3 below. A module 101 canrecord profile 107 d with ciphertext 208 b for a period of time, and thestep 207 can be taken (i) after recording profile 107 d, and (ii) beforemodule 101 authenticates with a wireless network 102 using the secondkey K 204. A step 207 can covert the ciphertext 208 b into plaintext,such that an eUICC 107 can read the values in order to authenticate witha wireless network 102 using the second key K 204.

A step 207 can convert the encrypted second key K 204 a into a plaintextkey K 204. As illustrated in FIG. 2a , a step 207 can also convert theencrypted network module identity 209 a into a plaintext network moduleidentity 209 as well. As discussed above in this FIG. 2a , the networkmodule 209 can be optionally omitted from a step 207, such that theplaintext network module identity 209 could be recorded in a profile 107d, and the plaintext network module identity 209 could be included inthe first portion, or ciphertext 208 a, in a profile 107 c. In anotherembodiment, the second network module identity 209 can be received bymodule 101 from wireless network 102 after the module authenticatesusing the first key K 203. Although not illustrated in FIG. 2a , aneUICC 107 can continue to record the plaintext network module identity209 and plaintext second key K 204 in an eUICC profile after the secondkey K 204 is decrypted using the symmetric key 127. The module 101 canrecord the second key K 204 in a protected memory address within ROM 101c or nonvolatile memory 101 w.

For embodiments where the first key K 203 is recorded within aciphertext 208 c in a profile 107 d after a step 206, the first key K203 can be converted from ciphertext 208 c into a plaintext first key K203 using a key deciphering step 217 as depicted and described inconnection with FIG. 2e below. The key deciphering step 217 could use anasymmetric ciphering algorithm 219 with input of (i) ciphertext 208 cand (ii) the eUICC private key 215 in order to output the plaintextfirst key K 203. As described above, the use of a ciphertext 208 c canbe optionally omitted, and the first key K 203 could be recorded asplaintext in a profile 107 d. In this case, a step 217 for data inprofile 107 d can be omitted, and thus step 217 with ciphertext 209 c isdepicted in FIG. 2a with a dashed line.

Although the first key K 203 and the second key K 204 a are depicted inFIG. 2a as recorded within an eUICC profile 107 c or eUICC profile 107d, the first key K 203 and the second key K 204 a can be (i) recorded ina nonvolatile memory of module 101, such as, but not limited to, a flashmemory 101 w, and (ii) without the use of an eUICC 107. In other words,embodiments contemplated herein can be used without an eUICC 107, suchthat (i) a module 101 can use a first key K 203 to authenticated with awireless network 102, (ii) after authentication with the first key K203, the module can receive a symmetric key 127 to decrypt the secondkey K 204 a into second key K 204, and (iii) the module can authenticatewith the wireless network 102 using the second key K 204. In otherwords, an eUICC 107 can be omitted and a module 101 can perform the samesteps for (i) receiving encrypted network access credentials and (ii)decrypting the encrypted network access credentials without requiringthe use of an eUICC 107.

In embodiments where a module 101 does not include an eUICC 107, themodule can record the first key K 203 and the encrypted second key K 204a in a file or memory address without requiring the use of a profile 107c and 107 d. For example, the first key K 203 could be recorded in aregular, physical UICC, and the second key K 204 a could also berecorded in a regular, physical UICC as well. The regular, physical UICCcould (i) receive the symmetric key 127 and decrypt the second key K 204a, and (ii) subsequently record the decrypted second key K 204. Themodule 101 and UICC could use the decrypted second key K 204 toauthenticate with the wireless network 102 where the first key K 203 waspreviously used. Other possibilities exist as well for a module 101 to(i) use a first key K 203 and an encrypted second key K 204 a withoutdeparting from the scope of the present invention.

FIG. 2b FIG. 2b is a graphical illustration for ciphering anddeciphering a profile using a symmetric ciphering algorithm with inputof a key, in accordance with exemplary embodiments. An eUICC profile 107d can be (i) ciphered using a profile ciphering algorithm 210 and (ii)deciphered with a profile deciphering algorithm 206. Both the profileciphering algorithm 210 and the profile deciphering algorithm 206 caninclude a symmetric ciphering algorithm 211 and the use of an eUICCprofile key 107 b. An eUICC subscription manager 109, or another nodeoutside a module 101 as illustrated in FIG. 1a , can use a profileciphering algorithm 210 to encrypt an eUICC profile 107 c. Theprocessing and computational steps for performing a profile cipheringalgorithm 210 could be conducted on a server associated with the eUICCsubscription manager 109. The server associated with the eUICCsubscription manager 109 can be similar to a server 105 illustrated inFIG. 1a , with the difference being the server associated with the eUICCsubscription manager 109 can be co-located, associated with, or underthe operational control of an eUICC subscription manager 109. Data foran eUICC profile 107 d used in a profile ciphering algorithm 210 cancomprise the exemplary data illustrated for a profile 107 d in FIG. 2aabove, and an eUICC subscription manager 109 could receive the data forthe profile 107 d from a mobile network operator 104. The mobile networkoperator 104 could process, generate, or derive the exemplary values ina profile 107 d that can include the network parameters 201, the firstnetwork module identity 202, the first key K 203, and the ciphertext 208b. As contemplated herein, the MNO 104 could also function as a eUICCsubscription manager 109, and thus in embodiments the profile 107 dcould be generated by a MNO 104 as well.

Symmetric ciphering algorithm 211 in a profile ciphering algorithm 210can utilize a key such as an eUICC profile key 107 b to encrypt orcipher data. Examples of symmetric ciphers for a symmetric cipheringalgorithm 210 include (i) an Advanced Encryption Standard (AES) cipher,as specified in Federal Information Processing Standards (FIPS)Publication 197, and (ii) Triple Data Encryption Standard (Triple DES),as described in NIST Special Publication 800-67 Revision 1,“Recommendation for the Triple Data Encryption Algorithm (TDEA) BlockCipher (Revised January 2012)”. Other symmetric ciphers and/orcombinations of symmetric ciphers can be utilized as well for asymmetric ciphering algorithm 210 without departing from the scope ofthe present invention. In general, a symmetric ciphering algorithm 211in a profile ciphering algorithm 210 (and other steps for symmetricciphering contemplated herein) can accept input of plaintext and a key,and using the two sets of input data, the symmetric ciphering algorithm211 can perform multiple rounds of mixing, substituting, rotating,and/or perform XOR functions with the input in order to produce aciphertext output. Although not illustrated in FIG. 2b and FIG. 2c , aset of cryptographic parameters can also be input into symmetricciphering algorithms 211 in order to specify parameters orconfigurations of the symmetric ciphering algorithm 211, such as, butnot limited to, the selection of 128, 192, or 256 bits with AES.

A cipher key used with a symmetric ciphering algorithm 211, such as, butnot limited to, the exemplary eUICC profile key 107 b can comprise arandom or pseudo-random number, with an appropriate length or number ofbits for the symmetric ciphering algorithm 211. The exemplary eUICCprofile key 107 b for use in a profile ciphering algorithm 210 could beshared between an eUICC subscription manager 109 and an eUICC 107 in amodule 101 in several different ways. The eUICC profile key 107 b couldbe recorded in or with the eUICC 107 upon manufacturing of module 101.The eUICC profile key 107 b could be securely received by a module 101using a wireless network 102 from the eUICC subscription manager 109before the module 101 performs a step that includes a profiledeciphering algorithm 206. An encrypted eUICC profile key 107 b could bereceived by module 101 and then decrypted by module 101 using anasymmetric ciphering algorithm 219 as depicted and described inconnection with FIG. 2e below. The eUICC profile key 107 b could also bederived by a module 101 and an eUICC subscription manager 109 (oranother server performing the steps in a profile ciphering algorithm210) using a key exchange such as, but not limited to, a Diffie-Hellmankey exchange or an Elliptic Curve Diffie-Hellman key exchange.

Other possibilities exist as well for a module 101 and an eUICCsubscription manager 109 (or another server performing the steps in aprofile ciphering algorithm 210) to securely share a eUICC profile key107 b without departing from the scope of the present invention. Inaddition, although a single eUICC profile key 107 b is illustrated inFIG. 2b , an eUICC subscription manager 109 and an eUICC 107 could usemultiple eUICC profile keys 107 b, including embodiments where a firstencrypted eUICC profile 107 c is associated with a first eUICC profilekey 107 b and a second encrypted eUICC profile 107 c is associated witha second eUICC profile key 107 b. Further, each encrypted eUICC profile107 c could be uniquely associated with a different eUICC profile key107 b. Each of the different eUICC profile keys 107 b could be securelytransferred between the eUICC 107 and the eUICC subscription manager 109using either (i) asymmetric ciphering 219 as illustrated in FIG. 2ebelow, or (ii) a key exchange, as depicted and described in connectionwith step 303 of FIG. 3 below.

With a profile ciphering algorithm 210, the symmetric cipheringalgorithm 211 can accept input of (i) the eUICC profile key 107 b, and(ii) and an eUICC profile 107 d plus an optional security token 212, inorder to output an encrypted eUICC profile 107 c. The encrypted eUICCprofile 107 c can be reasonably secured, such that deciphering theprofile 107 c without the eUICC profile key 107 b would be infeasible.After ciphering with a symmetric ciphering algorithm 211, decipheringthe ciphertext without the cipher key would require extensive dedicatedcomputational resources such as hundreds of servers or more for manyyears or longer. The optional security token 212 can include a string ornumber in order to enhance the security of the ciphertext output by asymmetric ciphering algorithm 211. The optional security token 211 couldcomprise a random number or other value, such that the input and outputof a symmetric ciphering algorithm 211 is properly padded, where thelength of input and output are appropriate for the symmetric cipheringalgorithm.

Although the input of eUICC profile 107 d is depicted in FIG. 2b with alabel of “plaintext”, the eUICC profile 107 d in a profile cipheringalgorithm 210, the “plaintext” eUICC profile 107 d can include encrypteddata such as ciphertext 208 b, where ciphertext 208 b can includeencrypted data ciphered with a different key than eUICC profile key 107b. In other words, a profile 107 c can include multiple layers ofciphering, where different layers use different cipher keys, and theexemplary a profile ciphering algorithm 210 with the eUICC profile key107 b can be used to encrypt the ciphertext 208 a illustrated in FIG. 2aabove. As noted above with FIG. 2a , ciphertext 208 b can be either (i)included inside ciphertext 208 a, or (ii) remain external to ciphertext208 a.

After a server associated with an eUICC subscription manager 109generates the output of an encrypted profile 107 c from a profileciphering algorithm 210, the encrypted profile 107 c can be transferredto module 101 through either unsecured channels, or channels that arenot under the full control of an eUICC subscription manager 109 or amobile network operator 104 associated with the profile 107 c. Themodule 101 can receive the profile 107 c through an IP network 111,including using the public Internet, or a manufacturer, distributor,technician, or end user could load the profile 107 c into the module(such as, but not limited to, using a USB interface 101 v). This initialloading of profile 107 c by a manufacturer, distributor, technician, orend user may be required for the first use or startup of a module 101,but then module 101 may preferably receive additional or subsequentprofiles 107 c at later times using IP network 111 and other automated,electronic means using a network including a wireless network 102.

A module 101 or an eUICC 107 within module 101 can process the encryptedprofile 107 c using a profile deciphering algorithm 206 as depicted inFIG. 2b and also depicted and described in FIG. 2a . Note that themodule 101 or eUICC 107 could record the encrypted profile 107 c for aperiod of time, and take the steps to decrypt the profile 107 c in aprofile deciphering algorithm 206 after receiving the eUICC profile key107 b associated with the profile 107 c. Or the eUICC profile key 107 bcould be recorded in a module 101 or with an eUICC 107 before profile107 c is received, and the steps for a profile deciphering algorithm 206could be performed after the receipt of an instruction from an eUICCsubscription manager 109 or at a specified time or under specifiedconditions (such as a module 101 needing or preferring to connect to awireless network 102 for the first time). An exemplary use and sequencefor a profile deciphering algorithm 206 is depicted and described inconnection with FIG. 3 below. Other possibilities exist as well for thetime that a module 101 or an eUICC 107 can process a profile decipheringalgorithm 206 without departing from the scope of the present invention.As contemplated herein, the use of the term “step 206” can refer to theuse of a profile deciphering algorithm 206, and a “step 207” can referto the use of a key K deciphering algorithm 207, etc.

A profile deciphering algorithm 206 can include a symmetric cipheringalgorithm 211. The symmetric ciphering algorithm 211 can be equivalentto or the same as the symmetric ciphering algorithm 211 in a profileciphering algorithm 210 operated by a server and as described above. Thesymmetric ciphering algorithm 211 can accept input of the eUICC profilekey 107 b as a cipher key. The module 101 or eUICC 107 could securelyreceive the eUICC profile key 107 b using the steps described above inconnection with a profile ciphering algorithm 210. An exemplary transferor key exchange for module 101 to receive eUICC profile key 107 b isalso described in FIG. 2e and FIG. 3 below. The symmetric cipheringalgorithm 211 in a profile deciphering algorithm 206 can also acceptinput of the encrypted eUICC profile 107 c, which could compriseciphertext 208 a.

The symmetric ciphering algorithm 211 in a profile deciphering algorithm206 can decrypt the ciphertext 208 a in order to output the profile 107d, where the ciphertext 208 a is converted to plaintext. Ciphertext 208b in a profile 107 c can remain encrypted using the symmetric key 127after a profile deciphering algorithm 206. In other words, the profiledeciphering algorithm 206 can convert a portion of the profile 107 cinto plaintext, where the portion comprises ciphertext 208 a. Asdepicted in FIG. 2a above, exemplary plaintext in a profile 107 dresulting from a profile deciphering algorithm 206 can include a firstnetwork module identity 202 and the first key K 203. The resultingplaintext from a profile deciphering algorithm 206 can also optionallyinclude a security token 212. Security token 212 could comprise thestring or value also optionally input into the symmetric cipheringalgorithm 211 in a profile ciphering algorithm 210. The security token212 can include a padding value to make the length of the security token212 and profile 107 d a desired value for the symmetric cipheringalgorithm 211 or other requirements such as making the encrypted profile107 c a desired length.

FIG. 2c

FIG. 2c is a graphical illustration for ciphering and deciphering a keyK using a symmetric ciphering algorithm with input of a key, inaccordance with exemplary embodiments. A second key K 204 a can be (i)ciphered using a key K ciphering algorithm 213 and (ii) deciphered witha key K deciphering algorithm 207. Both the key K ciphering algorithm213 and the key K deciphering algorithm 207 can include a symmetricciphering algorithm 211 and the use of a symmetric key 127. A mobilenetwork operator 104 can use a key K ciphering algorithm 213 to encryptthe second key K 204 a. The processing and computational steps forperforming a key K ciphering algorithm 213 could be conducted on aserver associated with the mobile network operator 104 such as a server105 illustrated in FIG. 1a . Other possibilities exist as well for thelocation or association of a computer to process a key K cipheringalgorithm 213 without departing from the scope of the present invention.

A key K ciphering algorithm 213 can include a symmetric cipheringalgorithm 211. The symmetric ciphering algorithm 211 can similar to thesymmetric ciphering algorithm 211 as depicted and described inconnection with FIG. 2b above. A symmetric ciphering algorithm 211 caninclude a collection of different symmetric ciphers, such that a firstsymmetric cipher comprising the AES cipher could be used in a FIG. 2b ,while a different symmetric cipher could be used in a FIG. 2c . Or, thesame algorithm within symmetric ciphering algorithm 211 can be used in asymmetric ciphering algorithm 211 in FIG. 2b and FIG. 2c . The symmetricciphering algorithm 211 in a key K ciphering algorithm 213 can acceptinput of a symmetric key 127 and plaintext in the form of a second key K204. The second key K 204 could represent a random number, such as, butnot limited to, an exemplary 128 random number currently used as ashared secret key K in standard LTE networks and a different length forsecond key K 204 could be used as well. The second key K 204 could bederived or processed by the function of an authentication center with ahome subscriber server (HSS). Although not illustrated in FIG. 2c , butas illustrated in FIG. 2a , the plaintext as input into a symmetricciphering algorithm 211 can also include a second network moduleidentity 209. The input into a symmetric ciphering algorithm 211 for akey K ciphering algorithm 213 can also include a number, value, orstring for a security token 212. The use of a security token 212 isdepicted and described in connection with FIG. 2b above. Thus, a mobilenetwork operator 104 could also use a key K ciphering algorithm 213 toencrypt other data in addition to a second key K 204.

The symmetric key 127 input into a symmetric ciphering algorithm 211 ina key K ciphering algorithm 213 can comprise a random number processedor generated by a server 105, where the server 105 is associated with amobile network operator 104. The server processing or deriving asymmetric key 127 can comprise or be associated with an HSS for an LTEor LTE advanced network. As illustrated in FIG. 2c , the symmetric key127 can comprise a cipher key for the symmetric ciphering algorithm 211.A cipher key used with a symmetric ciphering algorithm 211, such as, butnot limited to, the exemplary symmetric key 127 can comprise a random orpseudo-random number, with an appropriate length or number of bits forthe symmetric ciphering algorithm 211 in a key K ciphering algorithm213. Using the input of the symmetric key 127 and the plaintext secondkey K 204, the symmetric ciphering algorithm 211 could output anencrypted second key K 204 a. As illustrated in FIG. 2c and FIG. 2aabove, the encrypted second key K 204 a could be included in ciphertext208 b. The symmetric ciphering algorithm 211 in a key K cipheringalgorithm 213 may also optionally include a security token 212, asillustrated.

After processing the ciphertext 208 b, the mobile network operator 104can either (i) include the ciphertext 208 b in a profile 107 d and sendthe profile 107 d to an eUICC subscription manager 109, or (ii) send theciphertext 208 b directly an eUICC subscription manager 109 for theeUICC subscription manager 109 to include the ciphertext 208 b in aprofile 107 d. Ciphertext 208 b could be recorded in or with an eUICCprofile 107 d, where an eUICC subscription manager 109, or anotherserver associated with an eUICC subscription manager 109 cansubsequently encrypt the eUICC profile 107 d using a profile cipheringalgorithm 210 depicted and described in connection with FIG. 2b above.Other possibilities exist as well for the timing an sequence of stepsfor transferring and recording a ciphertext 208 b output from a key Kciphering algorithm 213 without departing from the scope of the presentinvention. After profile 107 d with ciphertext 208 b has been created,the profile 107 d can be ciphered with a profile ciphering algorithm 210to create an encrypted profile 107 c, as illustrated in FIG. 2b above.

The exemplary symmetric key 127 for use in a key K ciphering algorithm213 could be shared between a module 101 with an eUICC 107 and themobile network operator 104 in several different ways. The symmetric key127 could be sent from the mobile network operator 104 (possibly using aserver 105) to a module 101 after (i) the module properly authenticateswith the mobile network operator 104 and/or a wireless network 102associated with the MNO 104 using the first key K 203, and (ii) a user113 associated with the module 101 authenticates with the MNO 104. Notethat if MNO 104 sends the symmetric key 127 to module 101 after module101 uses the first key K 203 to authenticate, then the ciphering orencryption of the channel used to send the symmetric key K 127 can bewithin the control of MNO 104 (whereas the communications channel andciphering keys used to send encrypted profile 107 c may be outside thecontrol of MNO 104). The symmetric key K 127 could also be derived by amodule 101 and an MNO 104 using a key exchange, where the symmetric keyK 127 could be derived using a RAND 118 value received by the module 101after authenticating with the first key K 203, where the module 101and/or eUICC 107 derives the symmetric key K 127 using the RAND 118value and the first key K 203. Other possibilities exist as well for amodule 101 and a mobile network operator 104 to securely share asymmetric key 127 without departing from the scope of the presentinvention.

A module 101 or an eUICC 107 within module 101 can process theciphertext 208 b using a key K deciphering algorithm 207 as depicted inFIG. 2c . Note that the module 101 or eUICC 107 could record theciphertext 208 b for a period of time, and take the steps to decrypt theciphertext 208 b with a key K deciphering algorithm 207 after receivingor deriving the symmetric key 127. Or the symmetric key 127 could berecorded in a module 101 or with an eUICC 107 before ciphertext 208 b isdecrypted, and the steps for a key K deciphering algorithm 207 could beperformed after the receipt of an instruction from the MNO 104 todecrypt the second key K 204 a. An exemplary use and sequence for a keyK deciphering algorithm 207 is depicted and described in connection withFIG. 3 below. Other possibilities exist as well for the time that amodule 101 or an eUICC 107 can process a key K deciphering algorithm 207without departing from the scope of the present invention.

A key K deciphering algorithm 207 can include a symmetric cipheringalgorithm 211. The symmetric ciphering algorithm 211 can be equivalentto or the same as the symmetric ciphering algorithm 211 in a key Kciphering algorithm 213 performed by an MNO 104 and as described in thisFIG. 2c above. The symmetric ciphering algorithm 211 can accept input ofthe symmetric key 127 as a cipher key. The module 101 or eUICC 107 couldsecurely receive or derived the symmetric key 127 using the stepsdescribed above in connection with a key K ciphering algorithm 213. Thesymmetric ciphering algorithm 211 in a key K deciphering algorithm 207can also accept input of the encrypted key K 204 a, which could compriseciphertext 208 b. Additional data, such as, but not limited to a secondmodule identity 209 a could optionally be included within ciphertext 208b.

The symmetric ciphering algorithm 211 in a key K deciphering algorithm207 can decrypt the ciphertext 208 b in order to output the plaintextsecond key K 204, such that the ciphertext 208 b is converted toplaintext. The resulting plaintext from a key K deciphering algorithm207 can also optionally include a security token 212. Security token 212could comprise the string or value also optionally input into thesymmetric ciphering algorithm 211 in a key K ciphering algorithm 213.The security token 212 can include a padding value to make the length ofthe security token 212 and second key K 204 a a desired value for thesymmetric ciphering algorithm 211 or other requirements such as makingthe ciphertext 208 b a desired length.

FIG. 2d FIG. 2d is a graphical illustration of a public key and aprivate key for an eUICC, in accordance with exemplary embodiments. AneUICC 107 within a module 101 can include an eUICC private key 215,which can be associated with an eUICC public key 214. The eUICC privatekey 215 and eUICC public key 214 can comprise a public keyinfrastructure (PKI) key pair for eUICC 107. The eUICC subscriptionmanager 109 can record the eUICC public key 214 along with an eUICCidentity 107 a, such that the eUICC subscription manager 109 canproperly associate one of a plurality of eUICC public keys 214 with theproper eUICC 107. Although not illustrated in FIG. 2d , an eUICCsubscription manager 109 could record the eUICC public key 214 and anassociated eUICC identity 107 a in a database. The use of an eUICC ID107 a is also depicted and described in connection with FIG. 3 below.

The eUICC private key 215 and eUICC public key 214 could be processedusing RSA algorithms or elliptic curve cryptography (ECC) algorithms,and other possibilities exist as well for the format of PKI keys withoutdeparting from the scope of the present invention. An ECC key length of283 bits provides security similar to an RSA key length of approximately2048 bits, and in an exemplary embodiment the eUICC key pair can utilizean ECC algorithm, although an RSA algorithm or other algorithms for PKIkeys could also be utilized by an eUICC 107. The eUICC private key 215can be processed or derived using a random number. eUICC public key 214can comprise a key recorded in an X.509 certificate that also includes amodule identity 110 and/or eUICC identity 107 a, although the use of anX.509 certificate with an eUICC public key 214 is not required. TheeUICC public key 214 in the form of an X.509 certificate can optionallybe signed by a certificate authority. The keys can support standardssuch as, but not limited to, the International Organization forStandardization (ISO) ISO/IEC 9594 series of standards (hereinincorporated by reference) and the Internet Engineering Task Force(IETF) RFC 5280 titled “Internet X.509 Public Key InfrastructureCertificate and Certificate Revocation List (CRL) Profile” (hereinincorporated by reference), including future updates to these standards.

Several possibilities exist for the source of an eUICC private key 215and eUICC public key 214. The eUICC private key 215 and eUICC public key214 be generated using standard software tools such as, but not limitedto, Openssl, libmcrypt, and/or and Crypto++, and other tools to generatepublic and private keys exist as well. Public and private keys ascontemplated herein could be recorded in a file such as, but not limitedto, a *.pem file (Privacy-enhanced Electronic Mail), a file formattedaccording to Basic Encoding Rules (BER), Canonical Encoding Rules (CER),or Distinguished Encoding Rules (DER), or as text or binary file. Otherformats for public and private keys may be utilized as well, includingproprietary formats. A module 101 could derive the PKI key pair using aset of cryptographic algorithms and a key pair generation algorithm. Themodule 101 could derive the PKI key pair using a random number generator128 and a set of cryptographic algorithms 141, where the random numbergenerator 128 uses input from a sensor 101 f and/or a clock 160 in orderto obtain a random number with a high degree of information entropy.

A manufacturer of module 101 or an eUICC subscription manager 109 couldalso derive the eUICC private key 215 and eUICC public key 214 in aserver, and load the eUICC private key 215 into a nonvolatile memory ofmodule 101 before distribution of the module 101. The manufacturer ofmodule 101 could send or make available the eUICC public key 214 to aneUICC subscription manager 109. The module 101 could send record theeUICC public key 214 and send the eUICC public key 214 along with theeUICC identity 107 a (possibly with or in the form of a module identity110) to an eUICC subscription manager 109 before the module 101 receivesthe encrypted eUICC profile 170 c.

Although FIG. 2d illustrates an eUICC private key 215 and eUICC publickey 214, a module 101 could use a PKI key pair associated with module101 instead of being associated with an eUICC 107 in order to use anasymmetric ciphering algorithm as depicted in FIG. 2e below. In otherwords, a module 101 and an eUICC subscription manager 109 could use amodule private key 112 a and a module public key 112 b in order toobtain the same functionality of an eUICC private key 215 and an eUICCpublic key 214. A module private key 112 a and a module public key 112 bfor a module 101 could have the same properties and characteristics foran eUICC private key 215 and an eUICC public key 214 as describedherein. Other possibilities exist as well for the source or use of a PKIkey pair for an eUICC private key 215 and eUICC public key 214 withoutdeparting from the scope of the present invention.

In exemplary embodiments, both the eUICC subscription manager 109 andthe eUICC 107 can include a set of digital signature algorithms 221, inorder to sign and verify messages between (i) an eUICC 107 and eUICCsubscription manager 109, and (ii) eUICC subscription manger 109 and MNO104. Digital signature algorithms 221 can also verify signatures suchas, but not limited to, comparing that (i) a first secure hash valuereceived from a sending node matches (ii) a second secure hash valuecalculated using a recorded public key associated with the sending node.Digital signature algorithms 221 can utilize algorithms in NationalInstitute of Standards (NIST) “FIPS 186-4: Digital Signature Standard”,or IETF RFC 6979 titled “Deterministic Usage of the Digital SignatureAlgorithm (DSA) and Elliptic Curve Digital Signature Algorithm (ECDSA)”.The use of ECDSA algorithm within a set of digital signature algorithms221 may be preferred if keys such as, but not limited to, eUICC privatekey 215 and eUICC public key 214 are based on elliptic curvecryptography. Digital signature algorithms 221 could also include an RSAdigital signature algorithm (DSA) for use with RSA-based public andprivate keys. Other PKI standards or proprietary techniques for securelygenerating digital signatures and verifying digital signatures may beutilized as well in digital signature algorithms 221. As depicted anddescribed in connection with FIG. 3 below, a digital signature algorithm221 can be used in a step 205 in order to authenticate an eUICC 107operating in a module 101 with an eUICC subscription manager 109.

As illustrated in FIG. 2d , the eUICC subscription manager 109 may alsobe associated with an eUICC subscription manager public key 220 and aneUICC subscription manager private key 222, and the two keys cancomprise a PKI key pair for the eUICC subscription manager 109. TheeUICC subscription manager public key 220 and an eUICC subscriptionmanager private key 222 can be formatted and processed by algorithmsequivalent or similar to the algorithms and format for the eUICC publickey 214 and the eUICC private key 215 described in this FIG. 2d above.The eUICC subscription manager public key 220 can optionally be signedby a certificate authority. An eUICC 107 can use the digital signaturealgorithms 221 and the eUICC subscription manager public key 220 toverify a digital signature from the eUICC subscription manager 109.Although not illustrated in FIG. 2d , the eUICC 107 or module 101 couldalso record a public key associated with the mobile network operator104, and use the public key associated with the mobile network operator104 to verify a digital signature from the mobile network operator 104using the digital signature algorithms 221.

FIG. 2e

FIG. 2e is a graphical illustration for ciphering and deciphering a keyfor an eUICC using an asymmetric ciphering algorithm and a PKI key pair,in accordance with exemplary embodiments. An eUICC subscription manager109 could process or calculate a key ciphering algorithm 216 and amodule 101 or eUICC 107 could process or calculate a key decipheringalgorithm 217. The eUICC key ciphering algorithm 216 can use anasymmetric ciphering algorithm 219 with an input of (i) an eUICC publickey 214 as a cipher key and (ii) the eUICC profile key 107 b asplaintext in order to output ciphertext of an encrypted eUICC key 218.The plaintext eUICC profile key 107 b can comprise a random number ofappropriate length for processing a profile ciphering algorithm 210 andprofile deciphering algorithm 206 as depicted and described inconnection with FIG. 2b above. As illustrated in FIG. 2e , the inputinto a key ciphering algorithm 216 could also include an optionalsecurity token 212, where a security token 212 is depicted and describedin connection with FIG. 2b above.

An asymmetric ciphering algorithm 219 within a key ciphering algorithm216 and a key deciphering algorithm 217 an comprise an algorithm forutilizing public key infrastructure (PKI) techniques to both (i) encryptplaintext with a public key and (ii) decrypt plaintext with a privatekey. Example algorithms within asymmetric ciphering algorithm 219include an RSA algorithm and an elliptic curve cryptography (ECC)algorithm, and other asymmetric ciphering algorithms could be utilizedas well. The use and application of RSA algorithms and cryptography aredescribed within IETF RFC 3447 titled “Public-Key Cryptography Standards(PKCS) #1: RSA Cryptography Specifications Version 2.1”, hereinincorporated by reference, among other published standards for the useof RSA algorithms. The use of an RSA algorithm in an asymmetricciphering algorithm 219 for encryption and decryption, can also beprocessed according to the description of the RSA algorithm according tothe Wikipedia entry for “RSA (algorithm)” as of Sep. 9, 2013, which isincorporated by reference herein. The use and application of an ECCalgorithm for asymmetric ciphering algorithm 219 can conform withalgorithms within IETF RFC 6090 titled “Fundamental Elliptic CurveCryptography Algorithms” (herein incorporated by reference), among otherpublished standards using ECC. Asymmetric ciphering algorithm 219 canalso utilize elliptic curve cryptography algorithms for the Wikipediaentry for “Elliptic curve cryptography” as of Sep. 9, 2013, which isincorporated by reference herein.

ECC algorithms (with corresponding ECC-based PKI keys) may utilized forasymmetric ciphering algorithm 219 according to exemplary preferredembodiments in order to maintain high security with smaller key lengths,compared to RSA, thereby helping to comparably reduce the messagelengths, radio frequency spectrum utilization, and processing powerrequired by module 101. RSA algorithms (with corresponding RSA-base PKIkeys) for asymmetric ciphering algorithm 219 may be utilized in otherembodiments in order to maintain compatibility with deployed or legacysoftware and systems that supports RSA based keys and algorithms.

After an eUICC subscription manager 109 uses a eUICC key cipheringalgorithm 216 to convert a plaintext eUICC profile key 107 b into aciphertext as an encrypted eUICC key 218, the eUICC subscription managercan send the ciphertext to the module 101. The eUICC subscriptionmanager could send the ciphertext as an encrypted eUICC key 218 tomodule 101 using an IP network 111, and the IP network 111 couldcomprise the public Internet. In this manner, the module 101 cansecurely receive the encrypted eUICC key 218 in order to perform,process, or calculate a key deciphering algorithm 217. Third partieswith access to the encrypted eUICC key 218 would not feasibly be able toread the plaintext eUICC profile key 107 b, even with access to theeUICC public key 214. The module 101 could receive the encrypted eUICCkey 218 along with an eUICC profile identity 107 e in order to determinea profile 107 c associated with the encrypted eUICC key 218, where asubsequent step (after deciphering the encrypted eUICC key 218) couldcomprise a profile deciphering algorithm 206. The module 101 couldreceive the encrypted eUICC key 218 either before or after receiving theprofile 107 c.

After receiving the encrypted eUICC key 218, the module 101 or eUICC 107could decrypt the encrypted eUICC key 218 using a key decipheringalgorithm 217. A key deciphering algorithm 217 can include a asymmetricciphering algorithm 219. The asymmetric ciphering algorithm 219 can beequivalent to or the same as the asymmetric ciphering algorithm 219 in akey ciphering algorithm 216 operated or processed by an eUICCsubscription manager 109 as described in this FIG. 2e above. Theasymmetric ciphering algorithm 219 in a key deciphering algorithm 217can accept input of the eUICC private key 215 as a cipher key. Theasymmetric ciphering algorithm 219 in a key deciphering algorithm 217can also accept input of the encrypted eUICC key 218 as a ciphertext.The key deciphering algorithm 217 can use an asymmetric cipheringalgorithm 219 with an input of (i) an eUICC private key 215 as a cipherkey and (ii) the encrypted eUICC key 218 as ciphertext in order tooutput plaintext of an eUICC profile key 107 b. As illustrated in FIG.2e , the plaintext could also optionally include a security token 212.After processing a plaintext eUICC profile key 107 b from a keydeciphering algorithm 217, module 101 or eUICC 107 could use theplaintext eUICC profile key 107 b in order to perform a profiledeciphering algorithm 206 as illustrated in FIG. 2 b.

Although exemplary embodiments can include the use of a key cipheringalgorithm 216 and a key deciphering algorithm 217 in order to securelytransfer the eUICC profile key 107 b from an eUICC subscription manager109 to a module 101, a key ciphering algorithm 216 and a key decipheringalgorithm 217 can be omitted in other exemplary embodiments. Forexample, if the eUICC subscription manager and module 101 or eUICC 107support the use of a secure key exchange such as Diffie-Hellman or ECDH,then the eUICC profile key 107 b could be mutually derived by the twonodes and the encrypted eUICC key 218 would not need to be transferredthrough an IP network 111 between the two nodes.

In another embodiment, as depicted in FIG. 2e , the key cipheringalgorithm 216 and key deciphering algorithm 217 may also be used withciphertext 208 c with an encrypted first key K 203 and a plaintext ofthe first key K 203, if a profile 107 d includes ciphertext 208 c withencrypted first key K 203. In this case, a mobile network operator 104could perform the key ciphering algorithm 216 with input of (i) theplaintext first key K 203 and (ii) the eUICC public key 214 in order tooutput ciphertext 208 c. The ciphertext 208 c can include the encryptedfirst key K 203, although the ciphertext 208 c could also include otherdata such as the network parameters 201. The MNO 104 could send theciphertext 208 c (with the encrypted first key K) to the eUICCsubscription manager 109 in a step 302 b in FIG. 3 for inclusion in theprofile 107 d and profile 107 c. As depicted in FIG. 2e , a module 101or eUICC 107 could perform the key deciphering algorithm 217 on theciphertext 208 c with the first encrypted key K 203 in order to obtainthe plaintext first key K 203. In this manner, the first key K 203 isnot shared as plaintext with any entities besides the MNO 104 and amodule 101 with the eUICC 107. In other words, a MNO 104 can use a keyciphering algorithm 216 to prevent the sharing of a plaintext first keyK 203 with an eUICC subscription manager 109.

In addition, although FIG. 2e illustrates an eUICC subscription manageras performing the eUICC key ciphering algorithm 216 and the module 101or eUICC 107 as performing the eUICC key deciphering algorithm 217, analternative embodiment contemplates that the eUICC subscription manager109 performs the eUICC key deciphering algorithm 217 and the module 101or eUICC 107 performs the eUICC key ciphering algorithm 216. In thisalternative embodiment, the module 101 can (i) derive the eUICC profilekey 107 b, and (ii) send the ciphertext comprising the encrypted eUICCkey 218 to the eUICC subscription manager 109. In this alternativeembodiment, the module 101 can (i) use the eUICC subscription managerpublic key 220 to cipher the derived eUICC profile key 107 b, (ii) sendthe encrypted eUICC profile key 107 b to the eUICC subscription manager109, and (iii) the eUICC subscription manager 109 can decrypt theencrypted eUICC profile key 107 b using the eUICC subscription managerprivate key 222. In this alternative embodiment, the eUICC subscriptionmanager 109 could (i) use the eUICC key deciphering algorithm 217 todecrypt the encrypted eUICC key 218 received from the module 101, andthen (ii) subsequent encrypt the profile 107 d into a profile 107 cusing a profile ciphering algorithm 210 as depicted and described inconnection with FIG. 2b above.

FIG. 3

FIG. 3 is a simplified message flow diagram illustrating an exemplarysystem with exemplary data sent and received by a module with an eUICC,in accordance with exemplary embodiments. System 300 can include aneUICC subscription manager 109, an IP network 111, a mobile networkoperator 104, a module 101. A module 101 can include a networkapplication 101 x and an eUICC 107. The network application 101 x canperform the operations for communicating with the wireless network 102(i) at the data-link layer using standards for PLMN networks such as,but not limited to exemplary radio resource control standards withinETSI TS 136 331 v.10.7 entitled “LTE; Evolved Universal TerrestrialRadio Access (E-UTRA); Radio Resource Control (RRC); ProtocolSpecification”, which is herein incorporated by reference, and (ii) atthe network layer using Internet Protocol. Other standards forcommunication at the data-link layer between a network application 101 xand a mobile network operator 104 can be utilized as well withoutdeparting from the scope of the present invention. The (i) mobile device101, using the network application 101 x, and (ii) the mobile networkoperator 104 can send and receive data using the wireless network 102depicted and described in connection with FIG. 1a . Although a singlemodule 101 is illustrated in system 300 in FIG. 3, a system 300 couldinclude a plurality of modules 101.

The network application 101 x and the eUICC 107 can send and receivedata locally within the module 101 using an operating system 101 hand/or a system bus 101 d. The network application 101 x and the eUICC107 can send and receive data locally within the module 101 using aneUICC driver 128 as depicted and described in connection with FIG. 1b .The module 101, using a network application 101 x, can send and receivedata with the eUICC subscription manager 109 using the IP network 111.Note that a module 101 could include multiple network applications 101x, such that a first network application 101 x communicates withwireless network 102 and MNO 104, and a second network application 101 xcommunicates with an eUICC subscription manager 109. As illustrated inFIG. 3, the module 101 can send and receive data with the eUICCsubscription manager 109 in a step 205 using an initial network.

The initial network could comprise a different wireless network 102 thana wireless network 102 (i) for the mobile network operator 104, and (ii)used for a first authentication 304 and a second authentication 310. Inother words, module 101 can send and receive data for an eUICC profile107 c through a initial network that is different than the wirelessnetwork 102 associated with the mobile network operator 104. The networkapplication 101 x could support different standards for wirelessnetworking technologies, such that the different wireless network 102used to access the eUICC subscription manager 109 could compriseexemplary networks such as WiFi or LTE Advanced, and the networkapplication 101 x could use LTE to communicated with the mobile networkoperator 104. Other possibilities exist as well for the networkapplication 101 x to support communication with a variety of differentnetworks without departing from the scope of the present invention.

The left side of network application 101 x in FIG. 3 for communicationwith the mobile network operator 104 can comprise communication througha radio 101 z with the wireless network 102, and the right side ofnetwork application 101 x can comprise internal communication withinmodule 101 as described in the paragraph above. The internalcommunication between network application 101 x and eUICC 107 using anoperating system 101 h could comprise either (i) sharing memory 101 e,where module 101 writes data such as, but not limited to, an exemplaryRAND 118 value and eUICC 107 reads the values from the shared memory 101e, or (ii) using loopback UDP ports within operating system 101 h, suchthat network application 101 x sends a UDP datagram with the RAND 118value using a first UPD loopback port, and the eUICC 107 receives theUDP datagram with the RAND 118 value using a second UDP loopback port.For an operating system 101 h within module 101 using IPv4 addresses,the addresses used for the UDP loopback ports could comprise addressesin the range of the 127.0.0.0/8 address block. For an operating system101 h within module 101 using IPv6 addresses, the addresses used for theUDP loopback ports could comprise an ::1 address. In another embodimentillustrated in Figure if above, the eUICC 107 can communicate with theMNO 104 directly for embodiments where the eUICC 107 includes an IPaddress 106 c.

At a step 301, a module 101 can record an eUICC identity 107 a, anaddress 109 a of an eUICC subscription manager 109, and an eUICC privatekey 215 associated with the eUICC 107. A manufacturer, distributor,technician, end user, or installer of module 101 could record the datafor a step 301 in module 101, or the data could be downloaded oraccessed separately via an IP network 111, including the publicInternet. Other data could be included in a step 301 as well, such as,but not limited to, the software or firmware comprising the eUICC 107,an eUICC profile key 107 b, an eUICC public key 214, an eUICCsubscription manager public key 220, an eUICC driver 128, an initialprofile 107 d or 107 c, and policy rules for allowing access to theprofiles, and other additional data could be included in a step 301 aswell. Additional optional data for recording with an eUICC 107 in a step301 are depicted on the second line of step 301 in FIG. 3.

In an exemplary embodiment, a manufacturer of module 101 records theexemplary data for an eUICC 107 in a step 301, such that a module 101can being operations and connecting to an initial wireless network 102upon power-up in order to establish initial communications, includingallowing the communication with the eUICC subscription manager 109through the initial wireless network 102. As noted above in this FIG. 3,an initial wireless network 102 used for the eUICC 107 to access theeUICC subscription manager 109 can be different than the wirelessnetwork 102 used to access the mobile network operator 104. The address109 a of an eUICC subscription manager 109 could comprise either an IPaddress or a domain name, and in an exemplary embodiment the address 109a comprises a domain name and the module 101 can query for the IPaddress associated with the domain name for address 109 a via either adomain name system (DNS) query or a secured DNS query (DNSSEC). A module101 can connect with an initial wireless network 102 (different than thedepicted wireless network 102 in FIG. 3) after a step 301 in order tocommunicate with an eUICC subscription manager 109.

At a step 302 a, an eUICC subscription manager 109 could record data forthe eUICC 107. The data could include (i) an eUICC identity 107 a, (ii)a profile 107 c, (iii) an eUICC public key 214, (iv) an eUICCsubscription manager public key 220 and private key 222, (v) an eUICCprofile key 107 b with an associated eUICC profile identity 107 e, (vii)a module identity 110 (for embodiments where the module identity 110 forthe eUICC 107 is known before the eUICC 107 sends and receives data withthe eUICC subscription manager 109), (viii) and parameters for asymmetric ciphering algorithm 211 and an asymmetric ciphering algorithm219 used by the eUICC 107. The parameters for a symmetric cipheringalgorithm 211 and an asymmetric ciphering algorithm 219 used by theeUICC 107 could specify the ciphers used, such as (i) selecting anexemplary 128 or 192 bit keys for use with an AES cipher for a symmetricciphering algorithm 211 used with a eUICC 107 and eUICC identity 107 a,and (ii) selecting an exemplary elliptic curve or RSA algorithm for usewith an asymmetric ciphering algorithm 219. The eUICC subscriptionmanager 109 could also record related data for the operation of eUICC107 with eUICC subscription manager 109 in a step 302 a.

At a step 302 a, the eUICC subscription manager 109 could receive theprofile 107 d from the mobile network operator 104, and an exemplaryprofile 107 d is depicted and described in connection with FIG. 2a . Or,eUICC subscription manager 109 could receive a subset of data for theexemplary profile 107 d from the MNO 104 in a step 302 a withoutreceiving the entire profile 107 d. As one example, the MNO 104 may notknow the eUICC profile identity 107 e for the eUICC profile 107 d, andthus the MNO 104 may not send the complete profile 107 d but the MNO 104could send data for the profile 107 d to the eUICC subscription manager109 in a step 302 a. In an exemplary embodiment, the eUICC subscriptionmanager 109 could receive a subset of data for the profile 107 d usingthe IP network 111 over a secured link or connection to the MNO 104. Theprofile 107 d in a step 302 a could include both ciphertext 208 b andplaintext of a set of network parameters 201, a first network moduleidentity 202, and a first key K 203. As depicted and described inconnection with FIG. 2a , the ciphertext 208 b could comprise anencrypted second key K 204 a. The ciphertext 208 b could also includethe second network module identity 209 a. In an exemplary embodiment,the plaintext first key K 203 could be optionally omitted from beingreceived from an MNO 104 in a step 302 a, and the eUICC subscriptionmanager 109 can receive the first key K 203 in the form of a ciphertext208 c below in a step 302 b. The eUICC subscription manager 109 coulduse a server or a plurality of servers similar to a server 105 in orderto take the processing and communication steps described herein for aneUICC subscription manager 109 in this step 302 a and also additionalsteps for an eUICC subscription manager 109 described throughout FIG. 3.

After a module 101 powers up and established connectivity with the IPnetwork 111, an eUICC 107 operating in a module 101 could then perform astep 205 in order to receive an eUICC profile 107 c using the IP network111. The use and operation of a step 205 is also depicted and describedin connection with FIG. 2a above. In a step 205, an eUICC 107 could sendan eUICC identity 107 a to the eUICC subscription manager 109. Themodule 101 could use a network application 101 x to send the eUICCidentity 107 a, such as the network application 101 x writing data withthe eUICC identity 107 a to a physical interface 101 a, and the physicalinterface 101 a could include a radio 101 z. Or, using the exemplaryembodiment illustrated in FIG. 1e above, the eUICC 107 could beassociated with an IP address 106 c, and the eUICC 107 could send theeUICC identity 107 a to the eUICC subscription manager 109 without usinga separate network application 101 x associated with the wirelessnetwork 102. During a step 205 for a module 101 or eUICC 107, an eUICCsubscription manager 109 could receive the eUICC identity 107 a andperform a step 302 b. In an exemplary embodiment, both a module identity110 and an eUICC identity 107 a could be sent by an eUICC 107 or amodule 101 in a step 205. Or, the eUICC identity 107 a could comprise amodule identity 110, and the module identity 110 could be sent in a step205. Other possibilities exist as well for identifying a module 101 oran eUICC 107 with an eUICC subscription manager 109 without departingfrom the scope of the present invention.

In an exemplary embodiment, a message with the eUICC identity 107 a in astep 205 could include a digital signature, where the digital signatureis processed using (i) the eUICC private key 215 recorded in a step 301and (ii) a digital signature algorithm 221. The message with the eUICCidentity 107 a and a digital signature in a step 205 could preferablyinclude a random number or string, including a nonce or a “number usedonce” such as, but not limited to, an exemplary security token 212 inorder to prevent replay attacks.

An eUICC subscription manager 109 can take several actions in a step 302b after receiving an identity for the eUICC 107 or module 101. A firstaction in a step 302 b could comprise authenticating an eUICC 107 or amodule 101 based on the eUICC identity 107 a received in the message. Ina step 302 b, eUICC subscription manager 109 can authenticate themessage with eUICC identity 107 a according to message digest, or usingthe eUICC profile key 107 b which could be recorded in the eUICC 107 ina step 301 above. In addition, the eUICC subscription manager couldauthenticate using a digital signature algorithm 221, where the messagewith the eUICC identity 107 a could include a digital signature, asdescribed in the paragraph above.

Both the eUICC 107 and the eUICC subscription manager 109 could use theeUICC profile key 107 b as a cipher key with a symmetric cipheringalgorithm 211 to encrypt/decrypt data sent with the eUICC identity 107a, where the successful encryption and decryption of data with eUICCidentity 107 a using the eUICC profile key 107 b on both ends could beconfirmation that the eUICC 107 or module 101 is authenticated, sinceboth parties would only be able to mutually successfully encrypt anddecrypt by sharing the same eUICC profile key 107 b. In anotherembodiment, the eUICC profile key 107 b could be used as a private keywith a digital signature algorithm 211 (instead of the eUICC private key215), in order for the eUICC 107 with the eUICC 107 a to beauthenticated. For embodiments where the module 101 with the eUICC 107sends a digital signature with the eUICC identity 107 a, the eUICCsubscription manager 109 could use the eUICC identity 107 a to selectthe eUICC public key 214 or eUICC profile key 107 b from a database. Inthis manner, the eUICC subscription manager 109 could communicate with aplurality of eUICCs 107 and select the appropriate keys using the eUICCidentity 107 a.

A second action in a step 302 b could comprise the eUICC subscriptionmanager 109 authenticating with an eUICC 107 or a module 101. The eUICCsubscription manager 109 could also authenticate with an eUICC 107 at astep 302 b within a step 205, such that eUICC 107 can confirm anidentity of the eUICC subscription manager 109, using any of the same orequivalent steps described in the paragraph above for an eUICC 107 toauthenticate with an eUICC subscription manager 109. The eUICCsubscription manager 109 could send the eUICC 107 a digital signatureprocessed using a digital signature algorithm 221 and the eUICCsubscription manager private key 222. The eUICC 107 could verify thedigital signature using a eUICC subscription manager public key 220(which could be recorded with an eUICC 107 in a step 301). The eUICC 107could also receive data encrypted with a eUICC profile key 107 b, andsuccessful decryption of the data by the eUICC 107 using a symmetricciphering algorithm 211 could confirm the eUICC subscription manager 109also holds the eUICC profile key 107 b. Note that a system 300 couldinclude multiple eUICC keys 107 b, such that a first eUICC profile key107 b is used with a step 301 and step 205 in FIG. 3, and a second eUICCprofile key 107 b could be used with a subsequent step 206 below. Otherpossibilities exist as well for an eUICC 107 and an eUICC subscriptionmanager 109 to perform a 2-way authentication in a step 205 and a step302 b in FIG. 3 without departing from the scope of the presentinvention.

In another exemplary embodiment, where data received from an MNO 104does not include a plaintext first key K 203 for inclusion in a profile107 d, for a third action in a step 302 b, the eUICC subscriptionmanager 109 could send the eUICC identity 107 a (or the module identity110) and the eUICC public key 214 to the MNO 104. In this embodiment,the MNO 104 could also use the key ciphering algorithm 216 depicted anddescribed in connection with FIG. 2e above in order to encrypt the firstkey K 203 with the eUICC public key 214. The output of an MNO 104 usinga key ciphering algorithm 216 could comprise a ciphertext 208 c of anencrypted first key K 203. Thus, at a step 302 b for the embodimentdescribed in this paragraph, the eUICC subscription manager 109 couldreceive the first key K 203 for a profile 107 d as ciphertext 208 c(instead of a plaintext first key K 203 for profile 107 d in FIG. 2a ),In this manner, the first key K 203 in a profile 107 d could be recordedas ciphertext 208 c, which is also depicted and described as an optionalformat for the first key K 203 in FIG. 2a and FIG. 2 e.

In an exemplary embodiment, the MNO 104 can send the ciphertext 208 conly after a user 113 conducts a separate authentication step 308 bbelow. In other words, a step 308 b could also be used concurrently witha step 302 b, where the step 302 b includes the receipt of an encryptedfirst key K 203 in a ciphertext 208 c. In this manner, the MNO 104 canretain control over the release of an encrypted first key K 203, suchthat the first key K 203 in a ciphertext 208 c is only received by aneUICC subscription manager 109 in a step 302 or a eUICC 107 in a step205 after a user 113 (associated with the module 101 with the eUICC 107)authenticates with the MNO 104. In this embodiment, a separateauthentication step 308 b below can be optionally omitted, and the useof an encrypted second key K 204 a in ciphertext 208 b can also beomitted. In this embodiment, a user 113 of the module 101 can access thewireless network 102 of the mobile network operator 104 using the firstkey K 203 which has been (i) encrypted by the mobile network operator104 using a key ciphering algorithm 216 in a step 302 b, and (ii) onlyavailable to module 101 or eUICC 107 (or eUICC subscription manager 109)after a user 113 conducts an authentication step 308 b with MNO 104.

After the eUICC subscription manager 109 receives and/or processes allthe data for a profile 107 d, including subsets of data from a MNO 104described for this step 302 b above, a fourth action in a step 302 bcould comprise the eUICC subscription manager 109 ciphering a profile107 d using a profile ciphering algorithm 210, in order to convertprofile 107 d with plaintext into a profile 107 c with ciphertext. Someelements in a profile 107 c could remain plaintext as well, such as theexemplary profile identity 107 e. The eUICC subscription manager 109could use an eUICC profile key 107 b, where the eUICC profile key 107 bin a profile ciphering algorithm 210 can be different than an eUICCprofile key 107 b used to authenticate eUICC 107 with eUICC identity 107a. Or, the same eUICC profile key 107 b could be used to both cipherprofile 107 d and authenticate eUICC 107. Note that this fourth actionin a step 302 b could also take place at an earlier time than at step302 b, such that eUICC subscription manager 109 could assemble andcipher the profile 107 d into a profile 107 c at an earlier time, suchas before receiving the eUICC identity 107 a, or concurrent with a step301 a. Other possibilities exist as well for the timing and sequence foran eUICC subscription manager to assemble and process a profile 107 cwithout departing from the scope of the present invention.

After a step 302 b, the eUICC subscription manager 109 can send theauthenticated eUICC 107 a profile 107 c in a step 205, as depicted inFIG. 3. Either the eUICC subscription manger 109 or the eUICC 107 canselect the profile 107 c to be received by the eUICC 107. In oneembodiment, a module 101 can search for radio beacons from base stations103 for wireless networks 102 surrounding the module 101, and uponfinding new possible wireless network 102 to connect with, the module101 or eUICC 107 could query or request the eUICC subscription manager109 for a profile 107 c associated with a mobile network operator 104for a radio beacon observed by the module 101. Commercial businessarrangements among the user of module 101, the eUICC subscriptionmanager 109, and the mobile network operator 104 can determine theavailability of a profile 107 c for a module 101 with an eUICC 107.

In another embodiment, the eUICC subscription manager 109 couldperiodically send the module 101 and/or eUICC 107 new profiles 107 c asthey become available to a user 113 of a module 101 or available to theeUICC subscription manager 109. In a preferred embodiment, the eUICCsubscription manager 109 can send the profile 107 c to the module 101using a network application 101 x, where the network application 101 xforwards the data to the eUICC 107. As described above in this FIG. 3,the network application 101 x could communicate with the eUICC 107 usingthe operating system 101 h, and other possibilities exist as well. Notethat eUICC subscription manager 109 sends the profile 107 c, where thenetwork access credentials (including the first key K 203) are encryptedwith an eUICC profile key 107 b, and in this manner intermediate nodeson the IP network 111 would not feasibly be able to read the data withinthe profile 107 c.

In an exemplary embodiment, the eUICC subscription manager 109 can sendthe module 101 a pointer, uniform resource locator (URL), domain name,or related address for a location of the eUICC profile 107 c in a step205 as opposed to the actual, full profile 107 c. In this embodiment,the module 101 could receive the pointer, uniform resource locator,domain name, or related address for the location of the eUICC profile107 c and subsequently download the eUICC profile 107 c from an IPaddress associated with the pointer, uniform resource locator, domainname, or related address for a location of the eUICC profile 107 c.

As depicted in FIG. 3, after receiving the profile 107 c from the eUICCsubscription manager 109 in a step 205, the eUICC 107 can receive datafor decrypting the profile 107 c in a step 303. Note that if eUICCprofile key 107 b (in the form of a symmetric key as illustrated in FIG.2b ) has already be shared between the eUICC 107 and the eUICCsubscription manager 109 before a step 206 below, then a step 303 couldseparately be omitted. For example, if an eUICC profile key 107 b hasbeen recorded with an eUICC 107 in a module 101 by a manufacturer ofmodule 101, then that eUICC profile key 107 b could be used in a step206 below, and a separate step 303 could be omitted. In other exemplaryembodiments, the eUICC 107 can receive data for processing or derivingthe eUICC profile key 107 b for a step 206 below using the step 303illustrated in FIG. 3. A step 303 can include the receipt by eUICC 107of either (i) an encrypted eUICC key 218, or (ii) data for a keyexchange. The encrypted eUICC key 218 received by an eUICC 107 in a step303 could comprise an eUICC profile key 107 b that is ciphered using akey ciphering algorithm 216 illustrated in FIG. 2e . For embodimentswhere data for a key exchange is received in a step 303, the algorithmsused with a key exchange could comprise a Diffie Hellman key exchange,or an Elliptic Curve Diffie Hellman key exchange (ECDH).

An eUICC 107 within a module 101 could use a ECDH key exchange in a step303 when ECC algorithms are utilized for eUICC public key 214, eUICCprivate key 215, and eUICC subscription manager private key 222 andeUICC subscription manager public key 220. A summary of ECDH is includedin the Wikipedia article titled “Elliptic Curve Diffie-Hellman”(http://en.wikipedia.org/wiki/Elliptic_curve_Diffie%E2%80%93Hellman fromSep. 24, 2013, which is herein incorporated by reference. An ECDH keyexchange in a step 303 could comprise the message received by a eUICC107 including a common base point G. The base point G could also be sentfrom an eUICC 107 to eUICC subscription manager 109. The base point Gfor an ECDH key exchange in a step 303 could also be recorded with theeUICC in a step 301 above, and in this case the message at a step 303received by an eUICC 107 could comprise a signal to initiate or use akey exchange for deriving the eUICC profile key 107 b. Note that theeUICC subscription manager 109 and the eUICC 107 could take additionalsteps to process the eUICC profile key 107 b after an ECDH key exchangeat step 303, such as taking the output of an ECDH key exchange andinputting that output into a secure hash algorithm in order to obtainthe eUICC profile key 107 b. Other algorithms besides an ECDH or DiffieHellman key exchange can be utilized as well at a step 303, including akey exchange according to the American National Standards Institute(ANSI) standard X-9.63.

After completing a step 303, an eUICC 107 operating in a module 101could read and utilize the eUICC profile key 107 b. In embodiments wherethe eUICC profile key 107 b in a step 303 above comprises an encryptedeUICC key 218, a step 217 from FIG. 2e can be utilized by the eUICC 107in order to decrypt the eUICC key 218 into a plaintext of eUICC profilekey 107 b. The plaintext eUICC profile key 107 b can be used by theeUICC 107 in a step 206 to decrypt (x) the profile 107 c received in astep 205 above into (y) a profile 107 d. The use of an eUICC profile key107 b for a step 206 is also depicted and described in connection withFIG. 2a above and also FIG. 2b . Plaintext within a profile 107 d can beread after a step 206, although in exemplary embodiments and asillustrated in FIG. 2a , the profile 107 d can continue to recordciphertext 208 b and ciphertext 208 c.

In an exemplary embodiment, after a step 206 in FIG. 3 to convertreceived profile 107 c to profile 107 d, if (A) a ciphertext 208 c thatincludes the first key K 203 is present in profile 107 d (as depicted inFIG. 2a above), then (B) eUICC 107 could also use a key decipheringalgorithm 217 on ciphertext 208 c in order to extract the plaintextfirst key K 203. Note that ciphertext 208 a could be ciphered by aneUICC subscription manager 109 (using a profile ciphering algorithm 210)and ciphertext 208 b and/or ciphertext 208 c could be encrypted by amobile network operator 104 (using a key ciphering algorithm 216). Inother words, a module 101 with an eUICC 107 can use (i) a profiledeciphering algorithm 206 with an eUICC profile key 107 b to decryptciphertext 208 a, (ii) a key deciphering algorithm 217 with an eUICCprivate key 215 to decrypt ciphertext 208 c, and/or (ii) a key Kdeciphering algorithm 207 with a symmetric key 127 to decrypt ciphertext208 b.

After reading plaintext in profile 107 d, module 101 could then utilizethe profile 107 d to conduct a first authentication 304 with the mobilenetwork operator 104. As depicted in FIG. 3, the first authentication304 can comprise (i) module 101 sending an attach message 305 withnetwork module identity 202, (ii) the eUICC 107 and module 101 receivinga RAND 118, (iii) the eUICC 107 using a step 306 in order to calculate aRES 119, and (iv) the module 101 sending the RES 119. Although notillustrated in FIG. 3, a first authentication 304 could include otherdata such as receiving the equivalent of an “OK” message upon successfulauthentication, the receipt of additional network parameters 202 aftersuccessful authentication, etc. The module 101 can use a profile 107 dfrom a step 206 above in order to conduct the first authentication 304.The profile 107 d in an eUICC 107 could be selected and activated inorder to connect with a wireless network 102 associated with mobilenetwork operator 104. As contemplated herein and throughout the presentinvention, an activated profile 107 d can comprise a selected andenabled network access application state as illustrated in Figure D.1 ofETSI TS 103 383 v.2013-02 for the activated profile 107 d, and otherpossibilities exist as well. As illustrated in FIG. 3 after a step 206,the module 101 can use a network application 101 x in order to attach tothe wireless network 102 and communicate with the mobile networkoperator 104.

Within a first authentication 304, the module 101 can send a firstattach message 305, and the first attach message 305 can include thefirst network module identity 202. With a 4G LTE network, the firstattach message 305 could comprise a radio resource connection requestmessage, or a similar message could be utilized with other wirelessnetworking standards as well, such as LTE Advanced or WiMAX. Anexemplary radio resource connection request is described in section5.3.3 within ETSI TS 136 331 v.10.7 entitled “LTE; Evolved UniversalTerrestrial Radio Access (E-UTRA); Radio Resource Control (RRC);Protocol Specification”, which is herein incorporated by reference.Although not illustrated in FIG. 3, the module 101 and wireless network102/mobile operator 104 could take additional related steps beforesending the exemplary first attach message 305, such as, but not limitedto, module 101 synchronizing a clock 160 with wireless network 102,module 101 sending a message on a random access control channel (RACH)in order to have a timeslot and frequencies for sending the first attachmessage 305, etc.

As depicted in FIG. 3, after receiving and processing the first attachmessage 305, the mobile network operator can send a first random number(RAND) 118. Although not illustrated in FIG. 3, a network authenticationtoken “AUTN” and a sequence number could be sent with the first RAND118. An exemplary format for the use of a RAND 118 with a response RES119 is described in ETSI standard TR 131 900 v.10.0.0 and relateddocuments. In a first authentication 304 the module 101 and the eUICC107 can receive the first RAND 118. The eUICC 107 can conduct a step 306with an input of the first RAND 118 and the first key K 203 in order tocalculate a first RES 119. The use of a RAND 118 with a RES 119 in astep 306 could comprise a general use of a message digestauthentication, and another exemplary message digest authentication isalso described in IETF RFC 2617, titled “HTTP Authentication: Basic andDigest Access Authentication”. After receiving the exemplary first RAND118 message, in order to conduct a first authentication 304, module 101using an eUICC 107 could take steps to demonstrate to MNO 104 thatmodule 101 has access to the same first key K 203 as recorded by the MNO104 in a step 302 a or step 302 b above. MNO 104 could record theexpected RES 119 value with a set of authentication vectors 117 for thefirst network module identity 202, as depicted in FIG. 1 e.

Module 101 can properly respond to a challenge/nonce (such as a firstRAND 118) in a message digest authentication by sending a secure hashvalue calculated using (i) the challenge/nonce and (ii) the first key K203. The secure hash value can comprise the first RES 119. In exemplaryembodiments, eUICC 107 and wireless network 102 could use algorithmsspecified in ETSI TS 135 205-209, as well as subsequent and relatedstandards, in order for module 101 using eUICC 107 to (i) calculate asecure hash value, and (ii) process related steps for a firstauthentication 304. After processing a first RES 119 in a step 306 usingthe first key K 203, the eUICC 107 could send the first RES 119 to thenetwork application 101 x in module 101. Module 101 could then send thefirst RES 119 to the mobile network operator 104 using the wirelessnetwork 102, as depicted in FIG. 3 and thereby complete a firstauthentication step 304 for the module 101.

In another embodiment for a first authentication step 304, (i) module101 could send (i) the first network module identity 202 a digitalsignature processed using a digital signature algorithm 221 and theeUICC private key 215, and (ii) MNO 104 could verify the digitalsignature using a digital signature algorithm 221 and the eUICC publickey 214. Other possibilities exist as well for steps within a firstauthentication 304 using a eUICC private key 215 with the first networkmodule identity 202 or the eUICC identity 107 a in a firstauthentication step 304 without departing from the scope of the presentinvention. In an exemplary embodiment, as depicted in FIG. 1f above, theeUICC 107 could include an IP address 106 c with an interface identifier106 e associated with the eUICC 107, and in this case the module 101could send the first RES 119 value from the eUICC 107 to the MNO 104through the wireless network 102.

In a step 308 a the mobile network operator 104 can receive the firstRES 119. A server 105 such as a mobility management entity (MME) for themobile operator network 104 associated with the wireless network 102could compare the received first RES 119 with an internally recorded RES119 from the authentication vector 117. As noted above, theauthentication vector 117 could be received by the server 105 from theHSS of the mobile network operator 104 before a step 308 a. If thereceived first RES 119 matches the internally stored first RES 119value, the wireless network 102 and mobile network operator 104 canconsider or process that the module 101 is authenticated for a step 308a. The wireless network 102, the MNO 104, and the module 101 can takesubsequent steps (not shown) for the module 101 to access the IP network111, in order to conduct authentication of the module 101 or a userassociated with the module 101 with a second factor in a step 308 bbelow.

In a step 308 b, the mobile network operator 104 can conduct a separateauthentication of either a user 113 associated with a module 101 or themodule 101 using a second factor. In other words, the mobile networkoperator 104 can use a step 308 b to authenticate the user 113 of module101 or the module 101 using steps and a process that is different thanthe first authentication 304. Note that this use of a separateauthentication step 308 b can be different than conventional technologyused in authenticating a module 101 in a step 304, since other valuesand tokens besides the first key K 203 can be used in the authenticationstep 308 b. The additional authentication step 308 b can be useful for amobile network operator 104 to authenticate a module 101 with an eUICC107 and profile 107 d, since the profile 107 d with the first key K 203may be transferred to module 101 in a communications channel outside thecontrol of mobile network operator 104. As one example, the profile 107d with the first network key K 203 could be transferred to an eUICC 107from the eUICC subscription manager 109 using an IP network 111, asdepicted in FIG. 3 in a step 205. The mobile network operator 104 maynot have control over the IP network 111 used in a step 205. The mobilenetwork operator 104 may not have control over the security keys andalgorithms used to encrypt the profile 107 d into a profile 107 c, andthus the security of the first key K 203 upon which the MNO 104 dependsfor authentication and ciphering of data with module 101 may be outsidethe control of MNO 104. As one example, the MNO 104 may not be able toseparately authenticate the identity of a user of module 101 with theeUICC 107, before the profile 107 d was received by module 101 and eUICC107 in a step 205.

Consequently, without a separate authentication step 308 b the user 113of module 101 with the eUICC 107 may be unknown to MNO 104, and aseparate identity of the user 113 or module 101 (other than networkmodule identity 202) may preferably be authenticated in a step 308 b.Thus, a MNO 104 may use a separate authentication step 308 b in order toauthenticate a user 113 of module 101 with the eUICC 107 and the firstkey K 203 in exemplary embodiments. The user 113 can have a contractualor business relationship with MNO 104 in order to pay for voice and/ordata services from the MNO 104, and thus the MNO 104 can preferablyidentify and authenticate a user 113 in a step 308 b.

A step 308 b can comprise the authentication and/or secureidentification of (i) a user 113 of module 101 or (ii) module 101 usinga second factor. Although a step 308 b is depicted in FIG. 3 as beingperformed after a first authentication 304, a step 308 b could beperformed before a step 304 (including with a step 302 b as described instep 302 b above). The use of a second factor in an authentication step308 b can comprise a two-factor authentication, where the first factorcan be the successful completion of authentication using a step 304 andstep 308 a described above. The steps for authenticating a user 113 ormodule 101 in a step 308 b could comprise many different forms withoutdeparting from the scope of the present invention. In one embodiment,where the user 113 of module 101 comprises a subscriber totelecommunication and data services from MNO 104, the user 113 couldpresent identification to a representative of the MNO 104 in a step 308b. The identification could be in the form of a physical identity suchas, but not limited to, a drivers license or a passport (along with avalue that can be associated with the eUICC profile 107 d such as themodule identity 110 or the eUICC identity 107 a). The representative ofthe MNO 104 could record the identification in a web browser withconnectivity to a database shared by a server 105.

In another embodiment of an authentication of a user 113 of module 101(with the eUICC profile 107 d recorded with an eUICC 107 in module 101from a step 205) could enter information into a web page provided by MNO104, where the user 113 first (i) authenticates on the web page and then(i) enters identification information for the module 101 or eUICC 107.The user 113 could first authenticate with the MNO 104 via a web page byentering a valid identity and a password (where the identity andpassword for the web page in a step 308 b could be previouslyestablished between the user 113 and the MNO 104 before a step 308 b).In another embodiment for a step 308 b, a user 113 could call atelephone number operated by or associated with a MNO 104 and provideidentification information via voice or entering information such asdual-tone multi-frequency (DTMF) digits via interactive voice response(IVR). The identification information could include either a credit cardnumber or a personal identification number (PIN) for the user 113 (wherethe PIN may be previously shared or established between the user 113 andthe mobile network operator 104). The user 113 could also send a textmessage to MNO 104 from module 101 (i) using the module 101authenticated link with MNO 104 established in a first authentication304, where (ii) the text message include identification information fora user 113.

In accordance with preferred exemplary embodiments for the verificationof an identity of user 113 in a step 308 b (including an authenticationof user 113 in a step 308 b), the user 113 can send data to a MNO 104from module 101 using a data connection via wireless network 102associated with (and established after) the first authentication 304. Inthis manner, data and voice connectivity between the MNO 104 and module101 could be established with a first authentication step 304, and theuser 113 and MNO 104 can conduct an authentication step 308 b (orequivalently a verification of an identity of the user 113) to confirmthe identity of the user 113 via the established data and voiceconnectivity using the wireless network 102. In other words, the user113 could verify or authenticate an identity of the user 113 of module101 through the wireless network 102 in a step 308 b, where (a) module101 had conducted a first authentication step 304 and 308 a with MNO 104using the first key K 203 recorded in a profile 107 d, in order to (b)support or conduct a separate verification or authentication of a user113. In an exemplary embodiment, the user 113 could enter identifyinginformation for a step 308 b in a web page accessed through a userinterface 101 j on module 101, where data connectivity for the web pageis provided to module 101 through the wireless network 102 after a firstauthentication step 304.

The authentication or verification of user 113 identity in a step 308 bcan comprise authenticating module 101 with a second factor, where thefirst factor can comprise the first key K 203 and the second factor cancomprise information provided by a user 113 in a step 308 b. Otherpossibilities exist as well for those of ordinary skill in the art for(a) a user 113 of module 101 with the first key K 203 to (b)authenticate or verify an identity of the user 113 in a step 308 bwithout departing from the scope of the present invention. In theseexemplary embodiments for a user 113 to authenticate or verify anidentity for the user 113 for module 101 with the MNO 104, the MNO 104could record information or data received from the user 113 in adatabase, such that a server 105 for MNO 104 sends the symmetric key 127in a step 309 below after an identity of the user 113 is verified orauthenticated in a step 308 b. In exemplary embodiments illustrated inFIG. 3, the module 101 can access the wireless network 102 with thefirst key K 203 in order to (i) establish communication with the IPnetwork 111, (ii) support authentication of a user 113 in a step 308 bthrough the IP network 111, and then (iii) subsequently receive asymmetric key 127 in order to decrypt a ciphertext 208 b with a secondkey K 204 a.

In other exemplary embodiments, module 101 could comprise a modulesupporting “machine-to-machine” applications and communications, and themodule could be different than a traditional mobile phone or smartphonefor (i) placing voice telephone calls or (ii) supporting a userinterface 101 j in the form of a touch screen and web browser. Themodule 101 could include a sensor 101 f for collecting data and anactuator 101 y for controlling or changing a state associated with amonitored unit for the module 101. In these embodiments, and as depictedand described in connection with FIG. 1a , module 101 can be associatedwith an M2M service provider 115, and the M2M service provider 115 couldbe associated with a plurality of modules 101, as opposed to anindividual with a telephone number for voice services to module 101.

Each of the different modules 101 in the plurality of modules 101 couldinclude different values for module identities 110, eUICC identities 107a, profile identities 107 e, and the first network module identities202. In these embodiments for a step 308 b where the module 101 supportsM2M applications for an M2M service provider 115, in a step 308 b inFIG. 3, the MNO 104 could verify that (a) module 101 with eUICC 107 andthe profile 107 d from a step 304 is (b) properly associated with an M2Mservice provider 115. In exemplary embodiments, the MNO 104 ould conducta step 308 b by securely or properly determining that an identity frommodule 101 is associated with M2M service provider 115, and an exemplaryidentity for module 101 include any of a module identity 110, an eUICCidentity 107 a, a profile identity 107 e, and/or the first networkmodule identity 202.

In exemplary embodiments where module 101 supports M2M application andthe module 101 is associated with an M2M service provider 115, MNO 104could take several possible actions in a step 308 b for authenticatingor verifying that an identity from module 101 in FIG. 3 is associatedwith an M2M service provider 115. The proper association of an identityof module 101 with M2M service provider 115 may be necessary or usefulfor contractual and business relationships between MNO 104 and M2Mservice provider 115, such as, but not limited to, allowing MNO 104 tobill or invoice M2M service provider 115 for data services that MNO 104provides to module 101. In a first exemplary embodiment for a step 308 bin FIG. 3 where module 101 supports M2M applications with a M2M serviceprovider 115, MNO 104 could securely send to M2M service provider 115 anidentity of module 101, such as, but not limited to module identity 110,eUICC identity 107 a, profile identity 107 e, and/or the first networkmodule identity 202 through an IP network 111. The MNO 104 could alsosend the identity of module 101 in a query or request message. Althoughnot illustrated in FIG. 3, the MNO 104 could also send the M2M serviceprovider 115 a digital signature received from module 101 before a step308 b, where the digital signature was (i) processed by module 101 usinga digital signature algorithm 221 and an eUICC private key 215, and (ii)sent from the module 101 to the MNO 104.

In a step 308 b, the M2M service provider 115 could (i) receive theidentity of module 101 (such as, but not limited to module identity 110,eUICC identity 107 a, profile identity 107 e, and/or the first networkmodule identity 202), (ii) verify or determine the identity of module101 properly belongs to M2M service provider 115, and (iii) send aresponse confirming the module 101 with the identity is validlyassociated the M2M service provider 115. The response from the M2Mservice provider 115 (or data within a message from M2M service provider115 to MNO 114) for a step 308 b can comprise a second factor for MNO104 in authenticating module 101 with eUICC 107 and profile 107 d. Inthis manner, MNO 104 can confirm module 101 with the first networkidentity 202 is authenticated or verified as belonging to or beingassociated with M2M service provider 115 in a step 308 b.

In another exemplary embodiment for a step 308 b, the M2M serviceprovider 115 could also send MNO 104 a list of pre-authorized identitiesfor one or a plurality of modules 101 before a step 308 b (and in thiscase the list can comprise the second factor to authenticate module101). MNO 104 could query the list of identities received upon receivingan identity of module 101, such as, but not limited to, the firstnetwork module identity 202 received in the first attach message 305.Other possibilities exist as well for an MNO 104 to authenticate orverify that an identity of module 101 is associated with a M2M serviceprovider 115 in a step 308 b without departing from the scope of thepresent invention.

After successfully verifying or confirming in a step 308 b that module101 in FIG. 3 is associated with a known user 113 or M2M serviceprovider 115, MNO 104 can send a symmetric key 127 in a step 309. Anetwork application 101 x in the module 101 can receive the symmetrickey 127 and the module 101 can forward the symmetric key 127 to theeUICC 107. As depicted and described in connection with FIG. 2a and FIG.2c , the symmetric key 127 can be used by module 101 to decrypt theciphertext 208 b, where the ciphertext 208 b can include a second key K204 a. The symmetric key 127 can also previously be used by MNO 104 toencrypt the ciphertext 208 b. The ciphertext 208 b could be delivered toeUICC subscription manager 109 for including the ciphertext 208 b in theprofile 107 d, as described above in step 302 a. The ciphertext 208 bcould be sent to module 101 from the eUICC subscription manager 109across the IP network 111 as profile 107 c in a step 205 as describedabove in this FIG. 3.

In exemplary embodiments, the MNO 104 can send the symmetric key 127 ina step 309 through the wireless network 102, where the connectionbetween module 101 and MNO 104 could be initiated by the first attachmessage 305 and authenticated by a first authentication 304. Since theMNO 104 controls the nodes and ciphering steps for the transmission ofsymmetric key 127, the symmetric key 127 can be securely sent by MNO 104and received by module 101 with ciphering and keys used at the data-linklayer under the control of MNO 104 (whereas MNO 104 may not control thekeys and ciphering of sending the first key K 203). Also note noentities, including the module 101, a user 113, an M2M service provider115, an eUICC subscription manager 109, or unauthorized third partiescould feasibly read the ciphertext 208 b with the second key K 204 auntil they receive the symmetric key 127.

In an exemplary embodiment of a step 309 in FIG. 3, the symmetric key127 can first be encrypted with a key ciphering algorithm 216. Anencrypted symmetric key 127 ciphered with the key ciphering algorithm216 could be received by module 101 in a step 309. As described inconnection with a key ciphering algorithm 216 in FIG. 2e , the MNO 104could select and read the eUICC public key 214 (using a receivedassociated identity such as the first network module identity 202), anduse an asymmetric ciphering algorithm 219 to encrypt the symmetric key127. The module 101 could receive the encrypted symmetric key 127 anddecrypt the symmetric key 127 in a step 309 by using a key decipheringalgorithm 217 with the eUICC private key 215 and the asymmetricciphering algorithm 219. For a step 309 in FIG. 3, the use of encryptionfor a symmetric key 127 with an asymmetric ciphering algorithm 219 isoptional, and the symmetric key 127 could be sent in a form whereencryption is applied at the data-link layer according to standards forthe wireless network 102. Other possibilities exist as well for a module101 to securely receive a symmetric key 127 in a step 309 withoutdeparting from the scope of the present invention. As described above inconnection with a step 302 b, in exemplary embodiments, the module 101receives the symmetric key 127 after the MNO 104 authenticates orverifies that a user 113 or M2N service provider 115 is associated withmodule 101, and until the receipt of the symmetric key 127 theciphertext 208 b cannot be feasibly decrypted.

After a step 309, a module 101 with an eUICC 107 can use the symmetrickey 127 to decrypt ciphertext 208 b, where ciphertext 208 b can includethe second key K 204 a. A module 101 or eUICC 107 can use a key Kdeciphering algorithm 207 with input from the received symmetric key 127and the ciphertext 208 b from profile 107 d to output a plaintext secondkey K 204. Although not illustrated in a step 207 in FIG. 3, but asillustrated in a step 207 in FIG. 2a , a module 101 can use an eUICC 107to also decrypt a second network module identity 209 a for the secondkey K 204 using the symmetric key 127. The second network moduleidentity 209 a can be recorded in the ciphertext 208 b. The secondnetwork module identity 209 a can be different than the first networkmodule identity 202, such as a different number or value for an IMSI.The second network module identity 209 a can be the same length as thefirst network module identity 202. The use and operation of a key Kdeciphering algorithm 207 is also depicted and described in connectionwith FIG. 2a and FIG. 2e above.

The module 101 or eUICC 107 can record the plaintext second key K 204 ina nonvolatile memory such as, but not limited to, flash memory 101 wsuch that the plaintext second key K 204 remains available to module 101after power or a battery 101 k is removed from module 101. The plaintextsecond key K 204 could also be recorded in a protected memory withinmodule 101, such that the operating system 101 h or CPU 101 b mayprevent read or write access to the protected memory by other processesthan the eUICC 107. In other words, with a protected memory, otherapplications such as, but not limited to, applications that aredownloaded from an “app store” or equivalent and installed by end userson the module 101 may be prevented by the operating system 101 h fromhaving access to the plaintext second key K 204 recorded in theprotected memory.

In another embodiment, a module 101 may optionally not store theplaintext second key K 204 in nonvolatile memory, such that the secondkey K 204 continues to be recorded for a long-term basis only asciphertext 208 b in a nonvolatile memory such as flash 101 w. The module101 could perform a key K deciphering algorithm 207 each time aplaintext second key K 204 is needed for authentication purposes,including related key derivation of a CK and IK plus other derived keys.In this manner (by storing the second key K 204 in ciphertext 208 b inmodule 101) a plaintext second key K 204 may not be (i) stored in module101 for a relatively long time such as several hours or longer, and also(ii) recorded outside a nonvolatile memory.

In another embodiment, (A) the plaintext second key K 204 is recordedonly in a volatile memory within CPU 101 b such as a register or cachememory, where access to the register or cache memory is limited to theeUICC 107, and (B) after a successful authentication using the secondkey K 204, such as, but not limited to, a second authentication 311below, the plaintext second key K 204 is flushed from the register orcache memory within CPU 101 b. In this manner, after (A) a first timethat module 101 conducts a step 207 to obtain a plaintext second key K204 and the module 101 completes a full power cycling, then (B) theplaintext second key K 204 may not be recorded in any of a volatilememory, a non-volatile memory, or a protected memory within module 101(but module 101 could record an encrypted second key K 204 a in aciphertext 208 b).

For the embodiments where the second key K 204 is not recorded asplaintext in a nonvolatile memory within module 101, the module 101 canperform a step 207 with a ciphertext 208 b recorded in a nonvolatilememory a second time to process or obtain the plaintext second key K204. In other words, the second key K 204 can be recorded on a long-termbasis as a ciphertext 208 b for eUICC 107 within module 101, in anexemplary embodiment, thereby increasing the security of the second keyK 204. In this case, either (i) the symmetric key 127 could be recordedin a nonvolatile memory 101 w in order to allow decrypting of theciphertext 208 b, or (ii) the module 101 could receive the symmetric key127 a second time by conducting a step 309 a second time. The module 101can reconnect with the wireless network 102 and the MNO 104 using thefirst network identity 202 and the first key K 203 a second time, afterthe module 101 has already received the symmetric key 127 a first time.The MNO 104 may optionally authenticate the user 113 or M2M serviceprovider 115 a second time such as a second step 308 b (before sendingthe symmetric key 127 a second time) in order to confirm a second use ofthe first key K 203 is authorized.

After a module 101 with an eUICC 107 processes a key K decipheringalgorithm 207 to obtain a plaintext second key K 204, the module 101 canconnect with the wireless network 102 and mobile network operator 104using the second network module identity 209 and the second network key204. The module 101 using a network application 101 x could send asecond attach message 305 with the second network module identity 209.In another embodiment, the module 101 could send the second attachmessage 305 with the first network module identity 202, and in this casethe MNO 104 could record from the previous steps 302 b and 308 b that akey K associated with the first network module identity 202 shouldchange to the second key K 204.

But, given existing deployed infrastructure and systems for a mobilenetwork operator 104, the use of two different keys K with the samenetwork module identity may be more difficult to support, and for thiscase and with preferred embodiments, the module 101 attaches with theMNO 104 the second time with the second network module identity 209 thathas been deciphered from (i) a ciphertext 208 b in a step 207 above, or(ii) a ciphertext 208 a in a step 206 above. The second attach message305 can be equivalent to the first attach message 305, but with a changeof module 101 sending the second network module identity 209. With a 4GLTE network, the second attach message 305 could comprise a radioresource connection request message, or a similar message could beutilized with other wireless networking standards as well, such as LTEAdvanced or WiMAX. An attach message such as 305 in FIG. 3 could alsocomprise module 101 using a globally unique temporary identity (GTUI)that can be associated with the second network module identity 209.Other possibilities exist as well for the format or structure of anattach message 305 without departing from the scope of the presentinvention.

After sending the second attach message 305, the module 101 with a eUICC107 can conduct a second authentication 310 with the mobile networkoperator 104. The module 101 and eUICC 107 could take the equivalentsteps as the first authentication 304 depicted and described in thisFIG. 3, but with a difference of using the second network moduleidentity 209 and the second key K 204. In a second authentication 310,the mobile network operator 104 could send the module 101 a second RANDvalue 118 through the wireless network 102. A server 105 associated withMNO 104, such as, but not limited to, a HSS could have previouslyprocessed an authentication vector 117 comprising at least (i) thesecond RAND value 118, (ii) a network authentication token AUTN andsequence number (not shown), and (iii) a response value RES 119 for thesecond network module identity 209 and the second key K 204. The server105 or HSS associated with the MNO 104 could send the authenticationvector 117 to a server or MME that module 101 communicates with throughthe wireless network 102. The module 101 could receive the second RAND118 using the network application 101 x, and forward the second RAND 118to the eUICC 107. The communication steps between a network application101 x and an eUICC 107 in FIG. 3 could also use the steps depicted anddescribed in connection with FIG. 1e of U.S. patent application Ser. No.14/099,329, filed Dec. 6, 2013 in the name of John Nix, which is herebyincorporated by reference in its entirety.

At a step 311, the eUICC 107 could calculate the second RES 119 using(i) the second RAND 118 received and (ii) the second key K 204. Afterreceiving the exemplary second RAND 118 message, in order to conduct asecond authentication 310, module 101 using an eUICC 107 could takesteps to demonstrate to MNO 104 that module 101 has access to the samesecond key K 204 as recorded by the MNO 104 in an authentication vector117. The MNO could record the second key K 204 in an authenticationvector 117 a step 302 a or step 302 b above. Module 101 can properlyrespond to a challenge/nonce (such as a second RAND 118) in a messagedigest authentication by sending a secure hash value calculated using(i) the challenge/nonce and (ii) the second key K 204. The secure hashvalue can comprise the second RES 119. In exemplary embodiments, theeUICC 107 and wireless network 102 could use algorithms specified inETSI TS 135 205-209, as well as subsequent and related standards, inorder for module 101 using eUICC 107 to (i) calculate a secure hashvalue, and (ii) process related steps for a second authentication 310.After processing a second RES 119 in a step 311 using the second key K204, the eUICC 107 could send the second RES 119 to the networkapplication 101 x in module 101. Module 101 could then send the secondRES 119 to the mobile network operator 104 using the wireless network102, as depicted in FIG. 3 and thereby complete a second authenticationstep 310 for the module 101. In an exemplary embodiment, as depicted inFigure if above, the eUICC 107 could include an IP address 106 c with aninterface identifier 106 e associated with the eUICC 107, and in thiscase the module 101 could send the second RES 119 value from the eUICC107 to the MNO 104 through the wireless network 102.

At a step 312, the mobile network operator can receive the second RES119 from the module 101 using the wireless network 102. A server 105 forthe mobile operator network 104 associated with the wireless network 102could compare the received second RES 119 with an internally recordedRES 119. The server 105 could receive an authentication vector 117comprising at least the second RAND 118, second RES 119, and AUTN tokenfor the second network module identity 209 before sending the secondRAND 118 in a step 310 above. If the received second RES 119 matches theinternally stored second RES 119 value, the wireless network 102 andmobile network operator 104 can consider or process that the module 101is authenticated for a step 312. The wireless network 102, the MNO 104,and the module 101 can take subsequent steps (not shown) for the module101 to access the IP network 111, including allowing module 101 to placeand receive telephone calls and/or access the public Internet.

In an exemplary embodiment that utilizes the steps illustrated in FIG.3, the first key K 203 can comprise a null value or the number zero,which is contemplated in standards and supported by commercial wirelessnetworks 102 in order to support emergency services for a module 101without a valid UICC or eUICC. The MNO 104 and wireless network 102 canprovide limited access to the IP network 111, such that a user 113 ofmodule 101 with a null or zero value for the first key K 203 couldperforms steps to authenticate or verify the user 113 identity in a step308 b. The limited access to the IP network 111 may not include accessto the public Internet, but could include access to a server such as aweb server for the user 113 to enter identification information. Thedata-link layer may not be encrypted due to the use of a null value forthe first key K 203, but the application or transport layer could securecommunication from a web browser on the module 101 to the web server,such as using transport layer security (TLS). Other possibilities existas well for ciphering or securing data at the application or transportlayer in a step 308 b to authenticate a user 113 without encryption atthe data-link layer (such as without encryption by the wireless network102 due to a null value for first key K 203). In this embodiment wherethe first key K 203 comprises a null or zero value, after authenticationof a user 113 or M2M service provider 115 in a step 308 b, the secondkey K 204 used with a second authentication 310 can comprise a regularkey K such as a non-null value or a random number.

FIG. 4

FIG. 4 is a flow chart illustrating exemplary steps for a module to usean eUICC and authenticate with a wireless network, in accordance withexemplary embodiments. The processes and operations, described belowwith respect to all of the logic flow diagrams may include themanipulation of signals by a processor and the maintenance of thesesignals within data structures resident in one or more memory storagedevices. For the purposes of this discussion, a process can be generallyconceived to be a sequence of computer-executed steps leading to adesired result.

These steps usually require physical manipulations of physicalquantities. Usually, though not necessarily, these quantities take theform of electrical, magnetic, or optical signals capable of beingstored, transferred, combined, compared, or otherwise manipulated. It isconvention for those skilled in the art to refer to representations ofthese signals as bits, bytes, words, information, elements, symbols,characters, numbers, points, data, entries, objects, images, files, orthe like. It should be kept in mind, however, that these and similarterms are associated with appropriate physical quantities for computeroperations, and that these terms are merely conventional labels appliedto physical quantities that exist within and during operation of thecomputer.

It should also be understood that manipulations within the computer areoften referred to in terms such as listing, creating, adding,calculating, comparing, moving, receiving, determining, configuring,identifying, populating, loading, performing, executing, storing etc.that are often associated with manual operations performed by a humanoperator. The operations described herein can be machine operationsperformed in conjunction with various input provided by a human operatoror user that interacts with the computer.

In addition, it should be understood that the programs, processes,methods, etc. described herein are not related or limited to anyparticular computer or apparatus. Rather, various types of generalpurpose machines may be used with the following process in accordancewith the teachings described herein.

The present invention may comprise a computer program or hardware or acombination thereof which embodies the functions described herein andillustrated in the appended flow charts. However, it should be apparentthat there could be many different ways of implementing the invention incomputer programming or hardware design, and the invention should not beconstrued as limited to any one set of computer program instructions.

Further, a skilled programmer would be able to write such a computerprogram or identify the appropriate hardware circuits to implement thedisclosed invention without difficulty based on the flow charts andassociated description in the application text, for example. Therefore,disclosure of a particular set of program code instructions or detailedhardware devices is not considered necessary for an adequateunderstanding of how to make and use the invention. The inventivefunctionality of the claimed computer implemented processes will beexplained in more detail in the following description in conjunctionwith the remaining Figures illustrating other process flows.

Further, certain steps in the processes or process flow described in allof the logic flow diagrams below must naturally precede others for thepresent invention to function as described. However, the presentinvention is not limited to the order of the steps described if suchorder or sequence does not alter the functionality of the presentinvention. That is, it is recognized that some steps may be performedbefore, after, or in parallel other steps without departing from thescope and spirit of the present invention.

The processes, operations, and steps performed by the hardware andsoftware described in this document usually include the manipulation ofsignals by a CPU or remote server and the maintenance of these signalswithin data structures resident in one or more of the local or remotememory storage devices. Such data structures impose a physicalorganization upon the collection of data stored within a memory storagedevice and represent specific electrical or magnetic elements. Thesesymbolic representations are the means used by those skilled in the artof computer programming and computer construction to most effectivelyconvey teachings and discoveries to others skilled in the art.

At step 401, a module 101 can connect with a first wireless network 102.The first wireless network 102 could comprise a public land mobilenetwork, a local area network such as WiFi, or the use of white-spacespectrum. The module 101 could connect with the first wireless network102 in order to obtain access to IP network 111 which could comprise thepublic Internet, although the IP network 111 could comprise a privatenetwork in some embodiments. Although not depicted in FIG. 4, a step 401could also comprise the module 101 connecting to a wired network throughUSB interface 101 v. Upon conclusion of a step 401 the module 101 canuse an IP address such as IP address 106 b in Figure if in order tocommunicate with an eUICC subscription manager 109. As illustrated inFIG. 1f , in an exemplary embodiment the eUICC 107 could also have an IPaddress 106 c after a step 401, although the use of an IP address foreUICC 107 is not required and the module 101 can be associated with oneIP address for all external communications.

The module 101 can then use a step 205 in order to receive an eUICCprofile 107 c. The eUICC profile 107 c could be received from the eUICCsubscription manager 109 using the wireless network 102 and/or IPnetwork 111 from a step 401 above. The module 101 could record thereceived eUICC profile 107 c with the eUICC 107, including sending theeUICC profile 107 c to the eUICC 107 or sharing memory 101 e or 101 wbetween the eUICC 107 and a network application 101 x. The module 101could use a network application 101 x in order to receive the eUICCprofile 107 from the eUICC subscription manager in a step 205, asdepicted and described in connection with FIG. 3. The module 101 with aneUICC 107 could then decrypt the profile 107 c in a step 206 using aneUICC profile key 107 b. The eUICC profile key 107 b could be recordedwith an eUICC 107 before a step 206. The module 101 and/or eUICC 107could receive the eUICC profile key 107 b using a step 303 as depictedand described in connection with FIG. 3. The eUICC profile key 107 bcould be received using a key exchange, such as a Diffie-Hellman keyexchange or an ECDH key exchange. Or, the eUICC profile key 107 b couldbe recorded with the eUICC 107 by a module manufacturer. Otherpossibilities exist as well for a module 101 to record an eUICC profilekey 107 b before a step 206 without departing from the scope of thepresent invention. A module 101 and/or an eUICC 107 could use a profiledeciphering algorithm 206 in a step 206, as depicted and described inconnection with FIG. 2a and FIG. 2b . Upon conclusion of a step 206, aprofile 107 d could be recorded in an eUICC 107.

In a step 402, a module 101 can then select and activate the profile 107d from a step 206 in order to connect with a second wireless network102. A module 101 could take several possible steps in order to selectand activate the profile 107 d. A module 101 could use radio 101 z tosearch for radio beacons from base stations 103 for wireless networks102 surrounding the module 101, and upon finding the second wirelessnetwork 102 to connect with, the module 101 could select the profile 107d. The profile 107 d could include values in the set of networkparameters 201 that match or conform with values transmitted by thewireless network 102, such as using the same mobile country code (MCC)and mobile network code (MNC) as recorded in the profile 107 d. A module101 could receive an instruction from an eUICC subscription manager 109in order to activate the profile 107 d, where the instruction could bereceived through the first wireless network 102 in a step 401 above.

In another embodiment, a module 101 or eUICC 107 could query the eUICCsubscription manager 109 through the first wireless network 102 beforeactivating the profile 107 d in a step 402. Commercial businessarrangements among the user 113 of module 101, the eUICC subscriptionmanager 109, and the mobile network operator 104 can determine thetiming for activating a profile 107 d for a module 101 with an eUICC 107in a step 402, such as a user 113 entering a new contract for servicewith a MNO 104 for the profile 107 d. As contemplated herein andthroughout the present invention, an activated profile 107 d cancomprise a selected and enabled network access application state asillustrated in Figure D.1 of ETSI TS 103 383 v.2013-02 for the activatedprofile 107 d. Other possibilities exist as well for a module 101 toactivate a profile 107 d in a step 402 without departing from the scopeof the present invention.

In a step 304 in FIG. 4, a module 101 using eUICC 107 can conduct afirst authentication 304 with the second wireless network 102, using thefirst key K 203 recorded in the activated profile 107 d. The module 101could also send the first network module identity 202 from a profile 107d to the mobile network operator 104 in a step 304 in FIG. 4. The secondwireless network 102 in a step 304 in FIG. 4 can be associated with amobile network operator 104. The use of a first authentication 304 isalso depicted and described in connection with FIG. 3 above. As noted ina first authentication 304, the first key K 203 could comprise a keywith a null value in an exemplary embodiment, although a random numbercould be used for a first key K 203 as well. As depicted in FIG. 4, thesteps 401 through 304 could comprise substeps within a step 403. Thecombined substeps comprising a step 403 can be used by a module 101 inexemplary embodiments including an embodiment illustrated in FIG. 6below.

Although not depicted in FIG. 4, the mobile network operator 104 canconduct a separate step 308 b to authenticate module 101 or a user 113of module 101 using a second factor after a step 304. As described in astep 308 b above, the second factor could comprise verifying orauthenticating an identity of a user 113 associated with module 101.Note that the authentication of a user 113 can be conducted through themodule 101 accessing a server 105 or a web page through the IP network111 via the second wireless network 102 after the first authentication304 using the first key K 203 (including embodiments where the first keyK 203 comprises a null value).

In a step 309, the module 101 can receive a key from the second wirelessnetwork. The key in a step 309, as depicted in FIG. 3 above, cancomprise a symmetric key 127 in order to decrypt a ciphertext 208 bwithin profile 107 d. As also contemplated and described in connectionwith a step 309 in FIG. 3, the key could comprise a module 101 receivinga ciphertext that includes a symmetric key 127 that has been cipheredwith a key ciphering algorithm 216 using an asymmetric cipheringalgorithm 219 and the eUICC public key 214, as illustrated in FIG. 2e .For a key ciphering algorithm 216 used with a step 309, (i) thesymmetric key 127 can comprise the plaintext (as opposed to the eUICCprofile key 107 b depicted in FIG. 2e ), and (ii) the MNO 104 couldoperate the key ciphering algorithm 216 instead of the eUICCsubscription manager 109 depicted. In this embodiment of a step 309, amodule 101 and/or an eUICC 107 could receive the key in the form of aciphertext of symmetric key 127 in a step 309 and decrypt the ciphertextof symmetric key 127 with the eUICC private key 215 in order to read aplaintext symmetric key 127.

In a step 207 in FIG. 4, the module 101 and/or eUICC 107 can decrypt theciphertext 208 b with the second key K 204 a using the symmetric key127. The module 101 can use a key K deciphering algorithm 207 asdepicted and described in connection with FIG. 2c above in order to readand record a plaintext second key K 204 from the ciphertext 208 b in theprofile 107 d, where the profile 107 d was previously decrypted andrecorded using a step 206 above. As depicted in FIG. 2a , the ciphertext208 b can also include a second network module identity 209 a, so theeUICC 107 can also read the plaintext second network module identity 209in a step 207, if a second network module identity 209 a is included ina ciphertext 208 b. In an exemplary embodiment, the second plaintext keyK 204 is recorded in a protected, nonvolatile memory such as, but notlimited to, a flash memory 101 w. In this embodiment, the protectednonvolatile memory could comprise a memory address designated by themodule 101, CPU 101 b, operating system 101 h, a module program 101 i,or the eUICC 107 as a memory address that can only be written and readby the eUICC 107. Other possibilities exist as well to those of ordinaryskill in the art for a plaintext second key K 204 to be recorded in aprotected, nonvolatile memory in a step 207 without departing from thescope of the present invention.

In another embodiment, as described in a step 207 in FIG. 3, the module101 could record the encrypted second key K 204 a in a nonvolatilememory, along with a symmetric key 127 (or an encrypted symmetric key127 ciphered by a key ciphering algorithm 216). The module 101 or eUICC107 could decrypt the encrypted symmetric key 127 in order to decryptthe ciphertext 208 b that contains the second key K 204 a each time themodule 101 or eUICC 107 needs to read a plaintext second key K 204 foran conducting an authentication step 310, plus the subsequent derivationof additional keys such as CK and IK, Kasme, Kupenc, etc. using theplaintext second key K 204 and a RAND 118 value.

After reading a plaintext second key K 204 from a ciphertext 208 b in astep 207 using the symmetric key 127, the module 101 and/or eUICC 107can conduct a second authentication 310 step using the plaintext secondkey K 204, in order to authenticate with the second wireless network102. The second wireless network 102 can comprise the same wirelessnetwork 102 the module 101 communicates with in a step 304 above. Theuse of a plaintext second key K 204 in a second authentication 310 stepis depicted and described in connection with FIG. 3. Although notillustrated in FIG. 4, the module 101 could send a detach message orequivalent to temporarily disconnect from the second wireless network102 after a step 309 and before a step 310 illustrated in FIG. 4. A step310 can comprise the module 101 sending a radio resource connectionrequest to the second wireless network 102 with a network moduleidentity associated with the second key K 204. A step 310 can becompleted by a module 101 and/or an eUICC 107 sending a RES 119 valuecalculated using (i) a RAND 118 received and (ii) the second key K 204.

Although not illustrated in FIG. 4, after a step 310 by a module 101and/or an eUICC 107, the MNO 104 could verify the RES 119 and then themodule 101 and the wireless network 102 associated with the MNO 104could take subsequent steps for a module 101 to have access to the IPnetwork 111 including the public Internet. The module 101 and/or eUICC107 could derive session keys (such as, but not limited to a key CK) forencrypting data through the wireless network using a RAND 118 receivedin a step 310 and the second key K 204, and the module 101 and/or eUICC107 could also derive an integrity key for a session (such as, but notlimited to, an integrity key IK). Using an authenticated module 101 froma step 310, the MNO 104 can meter services rendered to a module 101after a step 310 in order to bill or invoice a user 113 or M2M serviceprovider 115.

FIG. 5a

FIG. 5a is a graphical illustration of public keys, private keys, and akey derivation algorithm, in accordance with exemplary embodiments. AneUICC 107 within a module 101 can include an eUICC private key 215,which can be associated with an eUICC public key 214. The eUICC privatekey 215 and eUICC public key 214 can comprise a public keyinfrastructure (PKI) key pair for eUICC 107. The MNO 104 can record theeUICC public key 214 along with an eUICC identity 107 a, such that theMNO 104 can properly associate one of a plurality of eUICC public keys214 with the proper eUICC 107. Although not illustrated in FIG. 5a , aMNO 104 could record the eUICC public key 214 and an associated eUICCidentity 107 a in a database. The MNO 104 could receive the eUICC publickey 214 and the eUICC identity 107 a from an eUICC subscription manager109 through an IP network 111 in a step 302 a or step 302 b of FIG. 3.The use of, source, and additional details regarding an eUICC public key214 and eUICC private key 215 are also depicted and described inconnection with FIG. 2d above.

The mobile network operator 104 could also be associated with an MNOprivate key 501 and an MNO public key 502, which could comprise a PKIkey pair for the mobile network operator. The mobile network operator104 could process or derive the PKI key pair using steps and algorithmsequivalent to the steps and algorithms for an eUICC 107 to obtain theeUICC public key 214 and eUICC private key 215. The PKI keys depicted inFIG. 5a could be processed using RSA algorithms or elliptic curvecryptography (ECC) algorithms, and other possibilities exist as well forthe format of PKI keys without departing from the scope of the presentinvention. The public keys in FIG. 5a can comprise keys recorded in anX.509 certificate, although the use of an X.509 certificates with publickeys 214 and 502 are not required. The public key 214 and 502 in theform of an X.509 certificate can optionally be signed by a certificateauthority. As illustrated in FIG. 5a , the mobile network operatorpublic key 502 can be recorded in the eUICC profile 107 d. The MNO 104could send the MNO public key 502 to the eUICC subscription manager 109in a step 302 a or 302 b depicted and described in FIG. 3, and the eUICCsubscription manager 109 could include the MNO public key 502 in theprofile 107 d. An eUICC profile 107 d could also include the additionaldata for an eUICC profile 107 d as depicted and described in FIG. 2a ,in addition to the MNO public key 502.

As illustrated in FIG. 5a , the MNO 104 and eUICC 107 can both record akey derivation algorithm 503. Exemplary key derivation algorithm 503could support a Diffie Hellman key exchange, an Elliptic Curve DiffieHellman (ECDH) key exchange (ECDH), or similar algorithms for each nodeto mutually derive a key using public and private keys. For embodimentswhere (A) eUICC public key 214, eUICC private key 215, MNO public key502, and MNO private key 501 utilize (i) elliptic curve cryptography(ECC) and (ii) a common, shared elliptic curve, then (B) a keyderivation algorithm 503 in FIG. 5a can comprise an algorithm forconducting an ECDH key exchange. The use of an ECDH key exchange wasalso described and contemplated between an eUICC subscription manager109 and an eUICC 107 in step 303 in FIG. 3 above. For embodiments wherea key derivation algorithm 503 supports a Diffie Hellman key exchange,the key derivation algorithm 503 could record a multiplicative group ofintegers modulo p, where p is prime, and g is a primitive root mod p. Inexemplary embodiments, p can be sufficiently large, such as, but notlimited to, and exemplary prime number of at least 250 digits, and g canbe a small number, such as, but not limited to, the number 5. Inexemplary embodiments, additional values pertaining to the operation ofa key derivation algorithm 503 can be transferred between two nodesusing a token 505 described in a FIG. 5b and FIG. 5c below.

FIG. 5b

FIG. 5b is a graphical illustration of deriving a second key K usingpublic keys, private keys, and a key derivation algorithm, in accordancewith exemplary embodiments. A mobile network operator 104 could processa MNO key exchange algorithm 504 in order to output or determine asecond key K 204. A module 101 with an eUICC 107 could process an eUICCkey exchange algorithm 505 in order to output or determine the samesecond key K 204. The MNO key exchange algorithm 504 and the eUICC keyexchange algorithm 505 could include a key derivation algorithm 503, anda key derivation algorithm 503 is also depicted and described inconnection with FIG. 5a above. The MNO 104 and module 101 could share orcommunicate a key exchange token 506 in order to operate the keyexchange algorithm 505. In this manner, a module 101 with an eUICC 107and a mobile network operator 104 could mutually derive or share thesecond key K 204 without MNO 104 transmitting or sending the second keyK 204, even in an encrypted form such as a second key K 204 a in aciphertext 208 b, to either (i) eUICC subscription manager 109 in a step302 a or step 302 b, or (ii) to a module 101 in a profile 107 c.

For a MNO key exchange algorithm 504, a mobile network operator 104using a server 105 could input the mobile network operator private key501, the eUICC public key 214, and a key exchange token 506 into a keyderivation algorithm 503 in order to output the second key K 204. Notethat the key derivation algorithm 503 in both a MNO key exchangealgorithm 504 and an eUICC key exchange algorithm 505 can includeadditional or separate processing steps than those contemplated in aDiffie-Hellman key exchange and an ECDH key exchange. Additional stepsthan those contemplated in a Diffie-Hellman key exchange or ECDH keyexchange for a key derivation algorithm 503 include transforming keyoutput by these key exchange protocols into a key length and formatcompatible and suitable for a key K for use with wireless networks. In akey derivation algorithm 503, the output of a Diffie-Hellman keyexchange and an ECDH key exchange could be input into a secure hashalgorithm, such as SHA-256, which could then be truncated to select a128 bit second key K 204 using a key derivation algorithm 503. For a MNOkey exchange algorithm 504, the security key exchange token 506 candepend upon the algorithm used in a key derivation algorithm 503.

For embodiments where key derivation algorithm 503 comprises aDiffie-Hellman key exchange, the key exchange token 506 can compriseinteger values of p and g. Or, with a Diffie-Hellman key exchange thesecurity key exchange token 506 sent from a MNO 104 could comprise avalue equal to g{circumflex over ( )}a mod p where (x) the values or pand g have been previously shared between MNO 104 and eUICC 107, and (y)the value “a” can comprise the MNO private key 501. A security keyexchange token 506 received by MNO 104 for input into a key derivationalgorithm for a eUICC 107 could comprise a value of g{circumflex over( )}b mod p, where b comprises the eUICC private key 215. Forembodiments where key derivation algorithm 503 comprises an ECDH keyexchange, the key exchange token 506 can a common base point G. The basepoint G could also be (i) recorded in an eUICC profile 107 d, or (ii)sent from a mobile network operator 104 to module 101, or (iii) sentfrom the module 101 to the mobile network operator 104. Other algorithmsbesides an ECDH or Diffie Hellman key exchange can be utilized as wellat a step 503, including a key exchange according to the AmericanNational Standards Institute (ANSI) standard X-9.63, and a key exchangetoken 506 could include a number or value associated with these otheralgorithms for a key derivation algorithm 503.

For an eUICC key exchange algorithm 505, a module 101 with an eUICC 107could input the eUICC private key 215 and the mobile network operatorpublic key 502 into a key derivation algorithm 503. Note that the inputinto the key derivation algorithm 503 could also optionally include akey exchange token 506. The key derivation algorithm 503 in an eUICC keyexchange algorithm 505 could accept the input and output the second keyK 204. The key derivation algorithm 503 in an eUICC key exchangealgorithm 505 could be equivalent to the key derivation algorithm 503 ina MNO key exchange algorithm 504 described above. The key exchange token506 in an eUICC key exchange algorithm 505 could comprise a valuesimilar to the key exchange token 506 used in a MNO key exchange 504described above. In a Diffie-Hellman key exchange for a key derivationalgorithm 503 in a eUICC key exchange algorithm 505, the key exchangetoken 506 can comprise a value of either (i) integers p and g asdescribed in a MNO key exchange 504, or (ii) number g{circumflex over( )}a mod p. In an ECDH key exchange for key derivation algorithm 503 ina eUICC key exchange algorithm 505, the key exchange token 506 cancomprise a base point G. A key derivation algorithm 503 can output asecond key K 204. Other possibilities exist as well for the use of PKIkeys and tokens in key exchange algorithms for those of ordinary skillin the art without departing from the scope of the present invention.

FIG. 5c

FIG. 5c is a simplified message flow diagram illustrating an exemplarysystem with exemplary data sent and received by a module with an eUICC,in accordance with exemplary embodiments. System 500 can include aneUICC subscription manager 109, an IP network 111, a mobile networkoperator 104, a mobile device 101. A module 101 can include a networkapplication 101 x and an eUICC 107. The operation of a system 500 can besimilar to a system 300 in FIG. 3, except for the steps noted in thisFIG. 5c where different steps can be taken than those within a FIG. 3.As depicted for a system 500 in FIG. 5c , like numerals for steps andmessages for a system 500 in FIG. 5c can comprise like steps andmessages within a FIG. 3. Different numerals discussed below cancomprise different steps or messages for a system 500. Many of the samesteps common for a system 500 in FIG. 5c and a system 300 in FIG. 3 willbe summarized in this FIG. 5c , while differences between the twosystems (including the use of different numerals for different steps ormessages) are described in more detail herein. As described in a step302 a and 302 b in FIG. 3, a mobile network operator 104 can send theeUICC subscription manager 109 information for a profile 107 d in a step302 a or 302 b, where the information can include the network parameters201, the first network module identity 202, and the first key K 203. Thelisted exemplary data for a profile 107 d from the previous sentence arealso discussed for a profile 107 d in FIG. 2 a.

For a step 507 in a system 500, the MNO 104 can omit sending anencrypted second key K 204 a in a ciphertext 208 b within the data forthe profile 107 d. In other words, the profile 107 d can omit the secondkey K 204 in either a plaintext or ciphertext form after a step 507 in asystem 500. The second key K 204 for a module 101 with eUICC 107 can bederived by a mobile network operator 104 in a MNO key exchange algorithm504 and an eUICC key exchange algorithm 505 below in FIG. 5c . Thus, inan embodiment illustrated in FIG. 5c , the second key K 204 for a secondauthentication 310 does not need to be transferred to the eUICCsubscription manager 109 from MNO 104 for the eUICC subscription manager109 to include in a profile 107 d. Similarly, in a system 500, thesecond key K 204 does not need to be transferred to the eUICC 107 in aprofile 107 c. In embodiments where (x) the MNO sends network accesscredentials such as the first and second network module identities 202and 209 a and a first key K 203 are sent in a step 302 b, then (y) astep 507 to omit the sending of the second key K 204 could take placewith a step 302 b instead of the step 302 a as depicted. The MNO 104 cansend the first and second network module identities 202 and 209 a and afirst key K 203 in a step 302 a or a step 302 b to the eUICCsubscription manager 109. The MNO 104 can send to the eUICC subscriptionmanager 109 the first and second network module identities 203 and 209 aand a first key K 203 in a profile 107 d in a step 302 a or 302 b, andthe eUICC subscription manager 109 could receive the first and secondnetwork module identities 202 and 209 a and a first key K 203 in a step302 a or a step 302 b. Other possibilities for combinations of data sentfrom a MNO 104 to an eUICC subscription manager 109 in a step 302 a, 302b, and 507 without departing from the scope of the present invention.

As depicted in FIG. 5c , an eUICC 107 in module 101 could perform steps301, then step 205 to receive a profile 107 c, then receive an eUICCprofile key 107 b, and then convert the profile 107 c into a profile 107d using the eUICC profile key 107 b in a step 206. The eUICC profile key107 b could also be (i) ciphered with a key ciphering algorithm 216,sent from the eUICC subscription manager 109 as an encrypted eUICCprofile key 218, (ii) and then deciphered by a module 101 and/or eUICC107 with a step 217, as described in connection with FIG. 2e above. Themodule 101 and/or an eUICC 107 could (i) receive an encrypted eUICCprofile key 107 b in the form of an key 218 and (ii) use a keydeciphering algorithm 217 to decrypt the encrypted eUICC profile key 107b in order (iii) to read a plaintext eUICC profile key 107 b and then(iv) use the plaintext eUICC profile key 107 b to decrypt the ciphertext208 a.

As depicted in FIG. 5c , after a module 101 sends a eUICC identity 107 aand receives an eUICC profile 107 c in a step 205, the module 101 canconduct a step 206 in order to decrypt a ciphertext 208 a that caninclude a first key K 203 using an eUICC profile key 107 b. For theembodiments contemplated in FIG. 5c , where the second key K 204 can bederived or determined using a key exchange in steps 504 and 505 below,the second network module identity 209 a can be included in theciphertext 208 a (as opposed to being included in the ciphertext 208 bas depicted in FIG. 2a ). One reason can be that a ciphertext 208 b canbe omitted from an eUICC profile 107 d in embodiments where the secondkey K 204 can be mutually derived by the eUICC 107 and the MNO 104, sothere may be no need to include a separate ciphertext 208 b within theeUICC profile 107 d.

After reading a first network module identity 202 and the first key K203, the module 101 can conduct a first authentication 304. Note thatthe first key K 203 can comprise key with a null value, as contemplatedin wireless network 102 standards which support the use of emergencyservices where a module 101 may not include a valid first key K 203. Inthis case where the first key K 203 comprises a null value, the use of aciphertext 208 a can also be optionally omitted, such that the receiptof an eUICC profile key 107 b and the use of a ciphertext 208 a couldalso be optionally omitted and a profile 107 c could include plaintextfor the first key K 203 and network module identity 202. As depicted anddescribed in connection with FIG. 3, a module 101 and MNO 104 couldconduct a first authentication step 304 in order to authenticate themodule 101 using the first key K 203. The first key K could comprise anon-null value in exemplary embodiments. A step 306 to calculate a firstRES 119 value using the first key K 203 from a profile 107 d could beincluded in a first authentication step 304.

The mobile network operator 104 could compare the first received RES 119with a recorded RES 119 in order to authenticate the module 101 with theeUICC 107 in a step 308 a. A mobile network operator 104 canauthenticate the module 101 using a step 308 a in order to provideaccess to the IP network 111, and the access to the IP network 111 canbe limited (such as, but not limited to excluding access to the publicInternet after a step 308 a). The module 101 could use access to thelimited or restricted IP network 111 in order for a user 113 of module101 to conduct an authentication with the mobile network operator 104using a second factor, as described in a step 308 b in FIG. 3.

After authenticating the module 101 with the first network moduleidentity 202 and the first key K 203 in a step 308 a, the mobile networkoperator 104 could authenticate a user 113 or verify a M2M serviceprovider 115 is associated with the module 101 in a step 308 b. Theauthentication of a user 113 or M2M service provider 115 in a step 308 bcould comprise authenticating module 101 and/or eUICC 107 with a secondfactor, where the second factor comprises or includes a secureassociation of a user 113 or M2M service provider 115 with the module101. As described in FIG. 3 above, a step 308 b could result in thesecure association of an identity for the user 113 or the M2M serviceprovider 115 with an identity of the module 101. After conduction a step308 b as depicted and described in connection with FIG. 3 above, the MNO104 can record the second network module identity 209 in the eUICCprofile 107 d is associated with a particular user 113 or a particularM2M service provider 115.

In a step 308 b, the MNO 104 can also determine (i) the first networkmodule identity 202 used in step 304 is associated with other identitiessuch as module identity 110, profile identity 107 e, eUICC identity 107a, and the second network module identity 209. By (i) authenticating auser 113 or (ii) verifying an identity for module 101 is associated witha M2M service provider 115 in a step 308 b, MNO 104 can determine thesecond network module identity 209 (used in a subsequent authenticationstep 310) belongs to or is associated with a particular user 113 or M2Mservice provider 115. In other words, without a separate authenticationstep 308 b in FIG. 5 and FIG. 3, MNO 104 may not be able to securelydetermine that the second network module identity 209 from a profile 107d belongs to a particular user 113 or M2M service provider 115.

For embodiments where the module 101 is associated with a M2M serviceprovider 115, then a step 308 b in FIG. 5c could comprise the MNO 104verifying that an identity received in a first authentication 304 (suchas, but not limited to, the first network module identity 202) isassociated with an M2M service provider 115, such as, but not limited toeither (i) checking the identity in a list of identities for modules 101belonging to M2M service provider 115, or (ii) sending an identityreceived from module 101 during a first authentication 304 to M2Mservice provider 115 over an IP network 111, and receiving a responsefrom M2M service provider 115 in essentially real-time (such as within afew seconds). In other words, MNO 104 and/or M2M service provider 115could create an interface for MNO 104 to query or check that a module101 associated with M2M service provider 115 is authenticated in a step308 b, and other possibilities exist as well.

After successfully authenticating or verifying an identity of a user 113or an M2M service provider 115 is associated with module 101 in a step308 b, MNO 104 could process an MNO key exchange algorithm 504 in orderto record a second key K 204 for use in a subsequent secondauthentication 310 for module 101. The second authentication 310 can usedifferent network access credentials (i) associated with the module 101and (ii) obtained by module 101 using an eUICC key exchange algorithm505. Although not illustrated in FIG. 5c , a MNO 104 could obtain thedata for processing a MNO key exchange algorithm 504 in severaldifferent ways. A MNO 104 could receive the eUICC public key 214 for anMNO key exchange algorithm 504 from either (i) the module 101 or eUICC107 directly after the first authentication 304 or (i) the eUICCsubscription manager 109 in a step 302 b above, where the eUICCsubscription manager 109 could record the eUICC public key 214. Otherpossibilities exist as well for a MNO 104 to receive an eUICC public key214 associated with an identity for module 101 such as the eUICCidentity 107 a. The recording of an eUICC public key 214 with an MNO 104is also depicted and described in connection with FIG. 5a above.

For a MNO key exchange algorithm 504 in FIG. 5c , the MNO 104 could alsoinput a key exchange token 506 and a MNO private key 501, in addition tothe eUICC public key 214, as illustrated in FIG. 5b above. Afterperforming a MNO key exchange algorithm 504 in FIG. 5c , the MNO 104 canrecord the second key K 204 for the second module identity 209 (which isassociated with the first module identity 202 in the profile 107 d). Ascontemplated for a key exchange token 506 in FIG. 5a and FIG. 5c , thekey exchange token 506 could be any of the cases (A) initiallyprocessed, derived, or determined by the MNO 104, (B) shared between theMNO 104 and module 101 with the eUICC 107, such as, but not limited to,recording the key exchange token 506 in the profile 107 d, or (C)initially processed, derived, or determined by module 101. FIG. 5cillustrates an embodiment for case (A) with key exchange token 506,where the MNO 104 derives or determines the key exchange token 506 valueand subsequent sends the key exchange token 506 value to the module 101with the eUICC 107. The MNO 104 can send the key exchange token 506 in amessage 508, and a network application 101 x for the module 101 canreceive the key exchange token 506 in the message 508 and forward thekey exchange token 506 to the eUICC 107. For case (A) the MNO 104 canomit sending the key exchange token 506 until after the user 113 or M2Mservice provider 115 for module 101 has been successfully authenticatedor verified in a step 308 b.

In a related embodiment to the embodiment depicted in FIG. 5c , for case(B) with key exchange token 506, a separate message 508, to communicateor transfer the key exchange token 506 between the MNO 104 and module101 after a step 504, can optionally be omitted, since both sides (MNO104 and module 101) could record the key exchange token 506 before astep 505 by a module 101 with an eUICC 107 below. For case (B), the MNO104 could send a signal in a message 508 to the module 101 that theauthentication step 308 b of a user 113 or an M2M service provider 115has been successfully completed, and thus module 101 could proceed withan eUICC key exchange algorithm 505 using the recorded key exchangetoken 506.

For case (C) with key exchange token 506, the eUICC 107 could derive ordetermine the key exchange token 506 and subsequently send the keyexchange token 506 to the MNO in a message 508. In this case (C), theMNO 104 could receive the key exchange token 506 (i) before processingthe MNO key exchange algorithm 504, and (ii) using the connection withthe module 101 from the first authentication 304. For case (C), the MNO104 can require the successful completion of an authentication step 308b for a user 113 or M2M service provider 115 before accepting the keyexchange token 506 from the module 101.

In another exemplary embodiment, step 504 and step 505 can use differentvalues for the key exchange token 506, and both MNO 104 and module 101can send the tokens 506 in a message 508 to the other node. In exemplaryembodiments, a message 508 comprising the key exchange token 506 can betransferred through the IP network 111, where access to the IP network111 can be enabled by the first authentication 304 with the first key K203. Other possibilities exist as well for the transfer of a keyexchange token 506 between a MNO 104 and a module 101 with an eUICC 107for conducting a key exchange without departing from the scope of thepresent invention.

As depicted in FIG. 5c , a module 101 with an eUICC 107 can conduct aneUICC key exchange algorithm 505 in order to determine or read a secondkey K 204. As depicted and described for an eUICC key exchange algorithm505 in FIG. 5b above, the module 101 can input an MNO public key 502, aneUICC private key 215, and the key exchange token 506 into a keyderivation algorithm 503 in order to output the second key K 204. Notethat the number, value, or sequence of bits for the second key K 204determined by a MNO 104 in a step 504 can be equal to the number, value,or sequence of bits for the second key K 204 determined by a module 101with an eUICC 107 in a step 505. The mutual derivation of the second keyK 204 by a MNO 104 in a step 504 and a module 101 in a step 505 can bedifferent and superior to conventional technology for either (i) aphysical UICC or (ii) an eUICC, since the second key K 204 does not needto be transferred in either physical or electronic form, where theelectronic form could include encrypting the second key K 204 into aciphertext. Supporting the derivation of a second key K 204 as depictedand described herein can be superior to the electronic or physicaldistribution of a key K, since a different second key K 204 can beutilized by repeating steps 504 and 505 a second time, such as with adifferent key exchange token 506. In this manner, the second key K 204associated with the second network module identity 209 could be rotatedor changed periodically, thereby increasing the security of a system 500compared to the use of a static, non-changing second key K 204 for thelifetime of a module 101 with a profile 107 d.

After a step 505 in FIG. 5c , the subsequent steps and messages forcommunication between the module 101 and the MNO 104 can be the same orequivalent to those in FIG. 3 after a step 207. In other words, thesecond key K 204 as used by a module 101 and/or eUICC 107 forembodiments in a FIG. 5c can be equivalent or similar to the processingand recording steps depicted and described in FIG. 3, upon module 101with an eUICC 107 reading the second key K 204 in a step 207 in FIG. 3.In a system 500, the module 101 or eUICC 107 could record the second keyK 204 in a protected, nonvolatile memory as described in a step 207 ofFIG. 3. Other possibilities exist as well without departing from thescope of the present invention for the location or techniques of storingthe second key K 204 resulting from a step 505.

As depicted and described in connection with FIG. 6 below, the module101 could record the second key K 204 in a volatile memory (and notstoring the second key K 204 in nonvolatile memory), includingpotentially only within a register or cache memory of CPU 101 b. In thismanner, the security of the derived second key K 204 can be enhanced,since upon or after power off of a module 101, a third party could notprobe or read nonvolatile memory looking for the second key K 204. Sincea volatile memory could be flushed upon loss of power or othercircumstances, a MNO 104 and module 101 could repeat the steps 504 and505, respectively, including the transfer of a key exchange token 506, asubsequent time when a module 101 needs to process or derive a new,subsequent second key K 504. In other words, a module 101 can conduct astep 505 with a different key exchange token 506 at a later time afterthe first instance of a step 505 in order to derive a different,subsequent second key K 204.

After deriving the second key K 204 in a step 505 in FIG. 5c , themodule 101 with the eUICC 107 can authenticate with the MNO 104 usingthe wireless network 102, the second network module identity 209, thesecond key K 204. The module 101 could conduct a second authentication310 with the mobile network operator using the second key K 204, asdepicted in FIG. 5c , which is also equivalent to the secondauthentication 310 depicted in FIG. 3 above. Note that the module 101could detach or disconnect from the wireless network 102 (i) after asending/receiving a message 508 with key exchange token 506 and (ii)before sending the exemplary second attach message 305 with the secondnetwork module identity 209.

The eUICC 107 within module 101 could use (i) the second key K 204 froma step 505, and (ii) a second RAND 118 value from the MNO 104 tocalculate a second RES 119 value in a step 311. The eUICC 107 can sendthe second RES 119 to the network application 101 x, and the module 101can send the second RES 119 to the mobile network operator 104 throughthe wireless network 102. The MNO 104 could compete the secondauthentication in a step 312 by verifying the second RES 119 is correctusing (i) the second key K 204 derived by the MNO 104 in a step 504above, and (ii) the second RAND 118 value sent to the module 101. Uponsuccessful authentication using the second key K 204, as depicted anddescribed in connection with FIG. 3, the module 101 and MNO 104 couldtake subsequent steps after a step 312 for the module 101 to have accessto the IP network 111 and also the public Internet.

In another embodiment contemplated in FIG. 5c , the mobile networkoperator 104 can send the second key K 204 to the module 101 using thewireless network 102 in a message 508. In other words, the exemplarytoken 506 in FIG. 5c could comprise the second key K 204, as opposed toan exemplary key exchange token 506. In this embodiment, the use of akey derivation algorithm 503 in a step 504 could use input of a randomnumber from random number generator 128 into the key derivationalgorithm 503 (instead of PKI keys), and the output could be the secondkey K 204. Or, the key derivation algorithm 503 in a step 504 couldsimply assign a random number to the second key K 204. After a step 308b and step 504, the mobile network operator 104 could send the secondkey K 204 in a message 508. The second key K 204 in a message 508 couldbe encrypted using a key ciphering algorithm 216. The message 508 withthe second key K 204 as the token 506 could be received by the module101 and decrypted using a key deciphering algorithm 217. In anotherembodiment, the token 506 received by a module 101 could comprise (i)the second key K 204 as plaintext at the application layer, but (ii)ciphered at the data-link layer using the first RAND value from a step304 and the first key K 203. Other possibilities exist as well for atoken 506 to comprise a second key K 204 without departing from thescope of the present invention.

The order of many of the steps and messages depicted within a system 500could be changed without departing from the scope of the presentinvention. For example, a step 504 could also be conducted concurrentlywith a step 302 b (instead of with a step 308 b), such that a mobilenetwork operator 104 could calculate a second key K 204 using a MNO keyexchange algorithm 504 at the same time when MNO 104 sends the firstnetwork module identity 202 and first key K 203 to the eUICCsubscription manager 109. After receiving (i) an eUICC identity 107 afrom an eUICC subscription manager 109 and (ii) and an eUICC public key214 in a step 302 b, the mobile network operator 104 can process a MNOkey exchange algorithm 504 in order to calculate or process a second keyK 204.

In an exemplary embodiment, a mobile network operator 104 could receivea list of eUICC public keys 214 and eUICC identities 107 a from an M2Mservice provider 115 before eUICC subscription manager 109 receives theeUICC identity 107 a in a step 205. The MNO 104 could use the datareceived from a M2M service provider 115 (including a list of eUICCidentities 107 a and eUICC public keys 214) in order to derive thesecond key K 204 using a MNO key derivation algorithm 504 and the keyexchange token 506. The MNO 104 could send the key exchange token 506 toan eUICC subscription manger 109 before the eUICC subscription manager109 participates in a step 205 as illustrated in FIG. 5c , and the eUICCsubscription manager 109 could include the key exchange token 506 withthe eUICC profile 107 c, such that module 101 could receive the keyexchange token 506 in the eUICC profile 107 c.

In this embodiment (which can also comprise a case (B) for the transferof key exchange token 506 for a message 508 as described above), amodule 101 using an eUICC 107 with profile 107 d and key exchange token506 could potentially derive the second key K 204 before a step 308 b,but in preferred embodiments the mobile network operator 104 does notallow the use of the second key K 204 until after an authentication step308 b of a user 113 or M2M service provider 115. In another embodiment,the values for the first network module identity 202 and the secondnetwork module identity 209 could be the same or equal, such that themodule 101 uses the same network module identity for both firstauthentication 304 and a second authentication 310. In this case, theMNO 104 can support a change in key K used with the first network moduleidentity 202 from the first key K 203 to the second key K 204. The firstkey K 203 can be included in a profile 107 d, but the second key K 204can be derived by an MNO 104 using a step 504 and a module 101 using astep 505. Other possibilities exist as well for a MNO 104 and a module101 to mutually derive a second key K 204 for use with an eUICC 107without departing from the scope of the present invention.

FIG. 6

FIG. 6 is a flow chart illustrating exemplary steps for a module to usean eUICC and authenticate with a wireless network, in accordance withexemplary embodiments. An exemplary system 500 depicted and described inconnection with FIG. 5c can also support the repeated derivation of asecond key K 204 for a MNO 104 and module 101 with an eUICC 107. The useand support for different second keys K 204 over time can increasesecurity, since the second key K 204 can be securely and periodicallyrotated, thereby enhancing the security and efficiency of a system 500,compared to either (i) physically changing a UICC each time a new key Kis desired, or (ii) querying, downloading, and selecting a new profile107 c or profile 107 d each time the use of a different key K is desired(including steps to communicate and record a second key K 204 in theprofile 107 d). In other words, the use of multiple second keys K 204over time can be accomplished for the same profile 107 d.

A step 403 in FIG. 6 can comprise a module 101 with an eUICC 107conducting the substeps for a step 403 as depicted and described inconnection with FIG. 4. In a step 403, a module 101 could connect with afirst wireless network 102, receive an eUICC profile 107 c, decrypt theprofile 107 c using an eUICC profile key 107 b, activate the profile 107d, and authenticate with a second wireless network 102 using a first keyK 203 from the profile 107 d. As noted above, other possibilities existas well for a module 101 to record an eUICC profile 107 d, such as theloading of a profile 107 d by a manufacturer, without departing from thescope of the present invention.

After successful authentication of the module 101 at the conclusion of asubstep 304 in a step 403, a user 113 associated with the module 101could conduct an authentication step 308 b with the mobile networkoperator 104. A step 308 b can be useful for a mobile network operator104 to authenticate or securely associate (i) a module 101 with (ii) alegal entity contractually responsible for the services used by a module101. The use of a step 308 b is also described in FIG. 3. Note thatmodule 101 could be associated with an M2M service provider 115 insteadof a mobile phone subscriber such as an individual, and in this case theM2M service provider 115 could take steps before a step 308 b in orderto inform or confirm with MNO 104 that module 101 with an identity suchas module identity 110 or the first network module identity 202 belongsto or is associated with the M2M service provider 115.

In other words, a MNO 104 may not have control over the distribution orrecipient of a profile 107 c from an eUICC subscription manager 109 in astep 403, and a user authentication in a step 308 b allows a MNO 104 toconfirm, verify, or establish a contractual relationship with a user113. Business contracts and procedures for an MNO 104 to provide serviceto a module 101 with an eUICC 107 with profile 107 d could require thata user 113 successfully completes an authentication step 308 b (withexample steps described in FIG. 3 above), before the MNO 104 providesservice such as voice calls or access to the public Internet. The secondfactor in a step 308 b can be data communicated between the MNO 104 andthe user 113 to confirm an identity of the user 113. Examples of datafor the second factor in a step 308 b are described in connection with astep 308 b in FIG. 3. The first factor contemplated in a system 300 orsystem 500 can be the successful receipt of a RES 119 value in a firstauthentication 304. Upon conclusion of the step 308 b the MNO 104 couldsecurely determine and record that a module 101 with the first networkmodule identity 202 and/or the second network module identity 209 fromthe profile 107 d is associated with an authenticated user 113.

The module 101 could then perform a step 508 in order access a keyexchange token 506. As described for a key exchange token 506 in FIG. 5c, the module 101 could receive the token 506 in a step 508 (case A), orthe module 101 could send the token 506 in a step 508 (case B). Step 508can comprise sending or receiving the message 508 from FIG. 5c . The keyexchange token 506 could comprise a key exchange token 506 as depictedand described in connection with FIG. 5b . Or, as described for amessage 508 in FIG. 5c , the key exchange token 506 could comprise thesecond key K 204, such as the second key K 204 encrypted by MNO 104 witha key ciphering algorithm 216 and decrypted by the module 101 with theeUICC 107 using a key deciphering algorithm 217. The key exchange token506 at a step 508 could comprise parameters for a key derivationalgorithm 503, such as a base point G if elliptic curve cryptography PKIkeys are used with MNO public key 502, MNO private key 501, eUICC publickey 214, and eUICC private key 215.

In another exemplary embodiment, key exchange token 506 with a DiffieHellman key exchange for a key derivation algorithm 503 could comprise amultiplicative group of integers modulo p, where p is prime and g isprimitive root mod p. Other possibilities for a key exchange token 506in a message 508 exist as well without departing from the scope of thepresent invention, including the use of multiple values and numbers fora key exchange token 506. The key exchange token 506 transfer betweenMNO 104 and module 101 in a step 508 can use the second wireless networkafter the module 101 authenticates with the first key K 203, and thusthe data-link layer for transfer of the key exchange token 506 could beciphered using the first key K 203 (where a cipher key for the data-linklayer is derived from the first key K 203 and a RAND 118 from a firstauthentication 304).

A module 101 with an eUICC 107 could then perform a step 505, whichcould comprise an eUICC key exchange algorithm 505 as depicted in FIG.5c using (i) the token 506 from a message 508 above, and (ii) the eUICCprivate key 215 and MNO public key 502. The output from an eUICC keyexchange algorithm 505 can comprise the second key K 204. In anexemplary embodiment, the second key K 204 output from the eUICC keyexchange algorithm 505 is recorded within a memory of module 101 on atemporary basis. After obtaining and reading the second key K 204 from astep 505, the module 101 can conduct a second authentication 310 withthe MNO 104 using the second key K 204. The second key K 204 can beassociated with a second network module identity 209, which could berecorded in the profile 107 c and profile 107 d for the eUICC 107 from astep 403 above. Exemplary details and steps for a second authentication310 using the second key K 204 are depicted and described in connectionwith FIG. 3 and FIG. 5c above.

After the conclusion of the second authentication 310, the module 101could have access to the public Internet through the IP network 111 ofthe wireless network 102. After a step 310 and before a subsequent step601 below, the module 101 could continue using the second key K 204 withthe second network identity 209 in many additional repeated steps 310,such that module 101 could use the second key K 204 for an exemplaryperiod of time such as several days or several months, and otherpossibilities exist as well for the continued use of a second key K 204after a step 310 and before a step 601 in FIG. 6. For example, a module101 could repeat a step 311 in a second authentication 310 multipletimes with the same wireless network 102 using the same number of valuefor the second key K 204 during a period of time before a step 601.

At a step 601 in FIG. 6, a module 101 or a MNO 104 could determine ifthe use of a new second key K 204 is required or preferred. There couldbe several reasons that a different second key K 204 may be periodicallypreferred. Exemplary reasons include (i) the second key K 204 may onlybe temporarily stored within a volatile memory in CPU 101 b, such that apower cycle of module 101 or CPU 101 b could flush the volatile memory,and in this case module 101 and MNO 104 may need to derive a new secondkey K 204, (ii) ownership of module 101 may change, and business orlegal contracts could stipulate that a previous second key K 204 withthe prior owner of module 101 may no longer be valid and thus a newsecond key K 204 may be required, (iii) a MNO 104 and a module 101 orM2M service provider 102 may prefer to periodically rotate the secondkey K 204 in order to increase security of a system 500. For example, amodule 101 may have a planned lifetime of more than a decade, and giventhe speed of change for mobile networking technology, a module 101 mayprefer to support the change in a second key K 204 for accessing awireless network 102 without downloading and installing a new, differentprofile 107 d. Other possibilities exists as well for exemplary reasonswhy a module 101 and/or a MNO 104 could determine that the use of a new,second key K 204 is preferred or required in a step 601 withoutdeparting from the scope of the present invention. If a module 101 orMNO 104 determine a value of “no” for a step 601, then the module 101could continue periodically performing repeated second authentication310 steps using the same second key K 204, as illustrated in FIG. 6.

As depicted in FIG. 6, upon determination of a value of “yes” for a step601, a module 101 could return to a step 508 and receive another keyexchange token 506. As depicted in FIG. 6, the module 101 could use afirst authentication 304, which could comprise an authentication withthe first key K 203. A return to the first authentication 304 with thefirst key K 203 could be omitted in some embodiments, and thus the boxfor 304 depicted in FIG. 6 is a dashed line.

In this embodiment where module 101 or MNO 104 determine or evaluatesthat a new second key K 204 is preferred at a step 601, the module 101could return to a step 508 by attaching with the wireless network 102again using the first network module identity 202 and the first key K203. For example, if the second key K 204 is not available (such asbeing flushed from being stored only in a volatile memory, a potentialerror condition such as a reset of module 101, or the second key K 204is no longer preferred to be used), then the module 101 with the eUICC107 could use data recorded in the profile 107 d to reconnect with thewireless network 102. For example, the first key K 203 and the firstnetwork identity 202 may be recorded in generally accessible nonvolatilememory, such as, but not limited to, a flash memory 101 w within module101 and subsequently the first key K 203 and the first network identity202 could be used in a step 304 before a return to a step 508. Or, themodule 101 and MNO 104 could continue to use the previous second key K204 (if available) for a communications link to transfer the keyexchange token 506, and thus the use of a step 304 with the first key K203 is optional.

Upon return to a step 508 module 101 and MNO 104 could transfer a keyexchange token 506 as described in a step 508 in FIG. 6 above. Uponreturn to a step 508, the module 101 and MNO 104 could transfer a keyexchange token 506 that has a different value or number from a keyexchange token 506 transferred earlier (in order to support thederivation of a different second key K 204 than from a previousiteration). Using the new, different value for the key exchange token506, the module 101 with the eUICC 107 could derive a new, differentsecond key K 203. In this manner and by using the steps illustrated inFIG. 6, a second key K 204 could operate as a key K for “temporary use”,and a different second key K 204 for use in a subsequent authentication310 could be obtained by a repeated use of a step 505 with a new,different key exchange token 506 for module 101 connecting with the samewireless network 102.

The module 101 and MNO 104 could continue to use the same network moduleidentity (such as a second network module identity 209) upon a return tosteps 508 through 310, or the MNO 104 could also send the module 101 anew, different network module identity in a message 508 upon a return tosteps 508 through 310. A MNO 104 and a module 101 can repeat the use thesteps 508 through 601 depicted and described in this FIG. 6 in order toderive a series over time of second keys K 204 for the module 101 withthe eUICC 107. Each member of the series (comprising a different secondkey K 204) could be associated with the second network module identity209, and the second network module identity 209 could remain constant orcan also change to different numbers or values for use in a step 310.Supporting a change in the second key K 204 can both increase theflexibility and security of a system 500 and related systems for a userand a mobile network operator 104.

FIG. 7

FIG. 7 is a simplified message flow diagram illustrating an exemplarysystem with exemplary data sent and received by a network, in accordancewith exemplary embodiments. System 700 can include an eUICC subscriptionmanager 109, an IP network 111, a mobile network operator 104, a module101. A mobile network operator 104 can include a set of servers 710,where the set of server 710 include a server A 105 aa, server B 105 bb,and server D 105 dd. The operation of a system 700 can be similar to asystem 300 in FIG. 3, except for the steps noted in this FIG. 7 wheredifferent steps can be taken than those within a FIG. 3. As depicted fora system 700 in FIG. 7, like numerals for steps and messages for asystem 700 in FIG. 7 can comprise like steps and messages within a FIG.3. Different numerals discussed below can comprise different steps ormessages for a system 700. Many of the same steps common for a system700 in FIG. 7 and a system 300 in FIG. 3 will be summarized in this FIG.7, while differences between the two systems (including the use ofdifferent numerals for different steps or messages) are described inmore detail herein. A module 101 in system 700 can include an eUICC 107.

Server A 105 aa, server B 105 bb, and server D 105 dd can comprise a setof servers 710. Server A 105 aa, server B 105 bb, and server D 105 ddcould each have functionality and components similar to a server 105illustrated in FIG. 1d . Server A 105 aa can comprise a server toprocess or generate network access credentials such as pairs of thefirst network module identity 202 and the first key K 203. Server A 105aa could comprise a home subscriber server in 4G LTE or LTE Advancednetworks, or the equivalent functionality of an authentication center(AuC) in 2G and 3G networks based on ETSI/3GPP standards. Server B 105bb can comprise a server to process authentication requests from modules101 attempting to access the wireless network 102 associated with themobile network operator 104, and server B 105 bb could providefunctionality equivalent to a mobility management entity (MME) of a 4GLTE and 4G LTE advanced network.

Server D 105 dd can comprise a server to send and receive data with auser 113 or M2M service provider 115 in order for MNO 104 to conduct anauthentication step 308 b with user 113 or M2M service provider 115.Server D 105 dd could be a web server that provides web pages throughtransport layer security such as TLS or SSL. Server D 105 dd could alsoprovide an interactive voice response menu, such that a user could entervoice commands or dual-tone multi frequency digits into the IVR in orderto conduct an authentication step 308 b. Or, server D 105 dd could be aweb server that customer support representatives from MNO 104 access inorder to input data into a web page or similar graphical user interfaceafter the customer support representatives interact with the user 113 inorder to conduct an authentication step 308 b with the user 113. ServerD 105 dd could implement an interface for communicating with M2M serviceprovider 115 through an IP network, for the communication ofauthentication data 702 as described below.

At step 701, server A 105 aa can process or derive a first networkmodule identity 202, a corresponding first key K 203, a second networkmodule identity 209, and a corresponding second key K 204. Server A 105aa can uses the algorithms and procedures for generating these networkaccess credentials in a step 701 that are equivalent for generatingnetwork access credentials for a traditional, physical UICC. Server A105 aa can then conduct a key K ciphering algorithm step 213 in order toencrypt the plaintext second key K 204 into a ciphertext second key K204 a within a ciphertext 208 b. The second network module identity 209can also be encrypted into ciphertext 208 b in a step 213. MNO 104 canthen also store the symmetric key 127 used to encrypt the ciphertext 208b, and forward the symmetric key 127 to a different server, such asserver D 105 dd. Although not depicted in FIG. 7, the MNO 104 can recordthe symmetric key 127 with the first network module identity 202 in adatabase such as module database 105 k, where MNO 104 can later query orlookup the symmetric key 127 associated with the ciphertext 208 b usingthe first network module identity 202 received in a first attach 305.

MNO 104 can then send the first network module identity 202, thecorresponding first key K 204, the ciphertext 208 b, and a set ofnetwork parameters 201 to the eUICC subscription manager. In a step 302a, the eUICC subscription manager can receive the data and record thedata in an eUICC profile 107 d. In a step 302 a, the eUICC subscriptionmanager can also encrypt the profile 107 d using a profile cipheringalgorithm 210 and a eUICC profile key 107 b. As illustrated in FIG. 7,server A 105 aa can then send a first authentication vector 117 a toserver B 105 bb, where the first authentication vector (AV1) 117 acomprises a set of data for a first authentication step 304 and the datacan include a first RAND 118 and a first RES 119 values, where the RESvalue is processed using a set of cryptographic algorithms 141 and thefirst key K 203. The first authentication vector 117 a can also includea network authentication token (AUTN) and a sequence number, in orderfor a module using the first network module identity 202 and first key K203 to authenticate the wireless network 102 associated with the MNO104.

The module 101 with the eUICC 107 can then connect to an IP network 111in order to communicate with the eUICC subscription manager 109. The IPnetwork 111 can be different than the wireless network 102 associatedwith the MNO 104, and could represent a wireless network operated by adifferent MNO 104, a WiFi connection, Internet access using white spacespectrum, and other possibilities exist as well. The module 101 couldconduct a step 205 in order to receive the eUICC profile 107 c from theeUICC subscription manager using the IP network 111. Although notdepicted in FIG. 7, the module 101 could also record the eUICC profile107 c from a loading procedure by a manufacturer, distributor,installer, or end user of module 101, where the eUICC profile 107 c islocally loaded and the module 101 does not access the IP network 111 inorder to receive the profile 107 c. For a step 205, the module 101 cansend an eUICC identity 107 a to the eUICC subscription manager 109, andthe eUICC subscription manager 109 can conduct an authentication step302 b in order to authenticate the module 101 with the eUICC 107.Authentication of module 101 with eUICC 107 in a step 302 b is depictedand described in connection with FIG. 3 above.

After an authentication step 302 b, the eUICC subscription manager 109can send the module 101 the eUICC profile 107 c to the module 101through the IP network 111. As noted above, the eUICC profile 107 c caninclude network parameters 201, the first network module identity 202,and the first key K 203 in an encrypted form, and also include theciphertext 208 b. The eUICC profile 107 c can also include other datafor the operation of an eUICC 107 with an eUICC subscription manager 109and a module 101. A module 101 could request for the eUICC profile 107 cor a key to decrypt the eUICC profile 107 c upon observing the wirelessnetwork 102 or the expectation of connecting with the wireless network102 associated with MNO 104, and other possibilities exist as well forthe sequence and timing of receiving the eUICC profile 107 c and a keysuch as encrypted eUICC profile key 218 without departing from the scopeof the present invention.

In order to activate the eUICC profile 107 c, the eUICC subscriptionmanager can then send the module 101 a eUICC profile key 107 b or anencrypted eUICC profile key 218. In exemplary embodiments, the eUICCsubscription manager sends the encrypted eUICC profile key 218 in orderto prevent third parties from reading the plaintext eUICC profile key107 b. The module 101 could decrypt the encrypted eUICC profile key 218with a key deciphering algorithm 217 as depicted and described inconnection with FIG. 2e . The module 101 with an eUICC 107 can then usethe plaintext eUICC profile key 107 b from the encrypted eUICC profilekey 218 in order to decrypt the eUICC profile 107 c into a plaintexteUICC profile 107 d using a step 206. The module 101 can use a step 217in order to decrypt the encrypted eUICC profile key 218 into a plaintexteUICC profile key 107 b. After reading a plaintext eUICC profile 107 d,the module 101 can read a plaintext first network module identity 202and first key K 203, in addition to the network parameters 201.

The mobile network operator 104 using a server B 105 bb can then conducta first authentication 304 of module 101 using the first authenticationvector 117 a. The module 101 can connect to the wireless network 102associated with the MNO 104 using the network parameters 201. The serverB 105 bb can receive a first attach 305 message with the first networkmodule identity 202, and the server B 105 bb can send a first RAND 118.The module 101 can use a step 306 with the first key K 203 in order toprocess a response first RES 119 and send the first RES 119 to thewireless network 102. The server B 105 bb can receive the first RES 119.The server B 105 bb of MNO 104 can then perform a step 308 a to comparethe received first RES 119 with a RES 119 recorded with the firstauthentication vector 117 a, and the module 101 with eUICC 107 can beauthenticated in a step 308 a if the two values for the RES 119 match.The MNO 104 can then send a message 703 to the eUICC subscriptionmanager 109 that the profile 107 d with the first network moduleidentity 202 has been activated or used, and the eUICC subscriptionmanger 109 can subsequently deprecate, or record as used, the profile107 d and profile 107 c. The message 703 can include the first networkmodule identity 202, or another identity associated with the profile 107c, such as, but not limited to the eUICC profile identity 107 e or amodule identity 110. As described in FIG. 3, the first key K 203 couldalso comprise a null value, such that data in the data-link layer ofwireless network 102 is not encrypted, but subsequent authenticationdata 702 could be encrypted at the network and transport layer by usingtransport layer security (TLS) or similar encryption.

As noted with a step 308 a, MNO 104 can then provide at least limitedaccess to an IP network in order for module 101 to access server D 105dd. The successful completion of a step 308 a can enable the MNO 104 toprovide limited access to the IP network. MNO 104 could enable thelimited access by sending signals and messages from server B 105 bb toother servers and nodes within MNO 104 and a wireless network 102. Thelimited access to the IP network can allow module 101 to communicatewith server D 105 dd, and the IP network for this access can represent asubset of IP network 111. In other words, module 101 may not haveunlimited access to the globally routable public Internet after a step308 a and before a subsequent authentication steps 308 b and 310. In anexemplary embodiment, a user 113 can access a user interface 101 j ofmodule 101 in order to access a web page from server D 105 dd, and otherpossibilities exist as well, such as, but not limited to, user 113sending and receiving text messages or placing a voice call to an IVRoperated by server D 105 dd.

The user 113 can communicate with server D 105 dd in order to send andreceive authentication data 702 using the limited access to the IPnetwork. The authentication data 702 can comprise the data sent by auser in a step 308 b of FIG. 3, such as entering or sending usercredentials or related information to securely identify a user 113 withMNO 104. The authentication data 702 could include a user name andpassword for a web page or credit card information and like paymentinformation, and other possibilities exist as well. Although notillustrated in FIG. 7, the user 113 could exchange the authenticationdata 702 with a representative of MNO 104, and the representative couldinput the authentication data 702 into the server D 105 dd, possibly byusing a web page associated with server D 105 dd. Using theauthentication data 702, the MNO 104 can conduct a second authenticationstep 308 b. An authentication step 308 b is depicted and described inconnection with FIG. 3 above. The authentication step 308 b can comprisean authentication of a user 113 with a second factor, where the firstfactor can comprise the previous successful authentication step 304above. In an authentication step 308 b, the MNO 104 can verify anidentity of a user 113 associated with the module 101 that records thefirst network module identity 202 and first key K 203.

For embodiments where an M2M service provider 115 associated with aplurality of modules 101 including the module 101 in system 700, theauthentication data 702 could include a list of authorized modules orsimilar identification information for modules 101 belonging to the M2Mservice provider 115. In this case, where the authentication data 702comprises a list of identities for authorized modules 101 belonging toan M2M service provider 115, the authentication data 702 could becommunicated between MNO 104 and the M2M service provider 115 at a pointin time that is different than that illustrated in FIG. 7, such as MNO104 receiving the list of authorized modules 101 before a firstauthentication step 304. Or, the authentication data 702 could comprisea series of messages between a server D 105 dd and a server associatedwith the M2M service provider 115 after the module 101 completes thefirst authentication 304. The MNO 104 could query the M2M serviceprovider 115 with an identity of the module 101 (such as, but notlimited to, the first network module identity 202 or a module identity101 or an eUICC identity 107 a) in order to authenticate the module 101with a second factor in a step 308 b. Other possibilities exist as wellfor a MNO 104 to authenticate that module 101 is associated with an M2Mservice provider 115 in a second authentication step 308 b withoutdeparting from the scope of the present invention.

After the successful completion of a second authentication step 308 b ofa user 113 using a second factor (where data for the second factor couldbe included in authentication data 702), the MNO 104 could use a step309 in order to send the symmetric key 127 to the module 101 with theeUICC 107. A server D 105 dd could send the symmetric key 127 in thesame communications channel for the authentication data 702, and otherpossibilities exist as well. A server D 105 dd could send a signal toserver B 105 bb or another server associated with MNO 104, where thesignal enables MNO 104 to send the symmetric key 127 to the module. Inother words, without the successful second authentication step 308 bwith a server D 105 dd, the MNO 104 would not be enabled to send thesymmetric key 127 for the module 101 to decrypt and use the encryptedsecond key K 204 a.

The communications channel for the authentication data 702 couldcomprise a connection with transport layer security. Or, a server B 105bb could send the symmetric key 127 to the module 101 in a standardencrypted channel through the wireless network 102, where the standardencrypted channel could be established using the first authentication304. MNO 104 can control the security of data transmitted throughwireless network 102, and thus MNO 104 could be reasonably assured thattransfer of the symmetric key 127 through the wireless network 102 issecured. As noted for a step 309 in FIG. 3, the symmetric key 127 couldalso be encrypted with a key ciphering algorithm 216, where thesymmetric key 127 is input into an asymmetric ciphering algorithm 219.The public key associated with the asymmetric ciphering algorithm 219could be the eUICC public key 214 or possibly another public keyassociated with the module 101.

Also after the successful completion of a second authentication step 308b of a user 113 using a second factor (where data for the second factorcould be included in authentication data 702), the MNO 104 or server D105 dd could send a signal 705 to the server A 105 aa for server A 105aa to process or generate a second authentication vector 117 b. Thesecond authentication vector 117 b could include a second RAND 118 andsecond RES 119 for the second network module identity 209 and the secondkey K 204. The second authentication vector (AV2) 117 b could alsoinclude other data standard for a MNO 104 such as, but not limited to, anetwork authentication token (AUTN) and a sequence number, where thesequence number can prevent replay attacks. The server A 105 aa cansubsequently send the second authentication vector 117 b to the server B105 bb for the server B 105 bb to use in a third authentication 310.Note that use of a signal 705 is not required, and a server A 105 aacould potentially send the second authentication vector 117 b to aserver B 105 bb before a second authentication 308 b or even before afirst authentication 304. In an embodiment, the MNO 104 records thesecond network module identity 209 and second key K 204 at a step 701,and the second authentication vector 117 b could be sent to server B 105bb with the first authentication vector 117 a.

After receiving the symmetric key 127 in a step 309, the module 101 withthe eUICC 107 could conduct a step 207, where a step 207 is depicted anddescribed in connection with FIG. 2a and also FIG. 3. The module 101could use the symmetric key 127 to decrypt ciphertext 208 b in order toread a plaintext second key K 204. The second network module identity209 could also optionally be included in ciphertext 208 b (in the formof a second network module identity 209 a), or the second network moduleidentity 209 could be external to ciphertext 208 b and recorded asplaintext in an eUICC profile 107 d. After reading the plaintext secondkey K 204 and second network module identity 209, the module 101 and MNO104 could conduct a third authentication step 310. The server B 105 bbcould receive a second attach 305 message from the module 101 with thesecond network module identity 209.

The server B 105 bb could query a database or table such as moduledatabase 105 k that contains a plurality of authentication vectors 117with the second network module identity 209 in order to read the secondauthentication vector 117 b. The server B 105 bb could read a secondRAND 118 and second RES 119 from the second authentication vector 117 b.The server B 105 bb could send the second RAND 118 over the wirelessnetwork 102 to the module 101. The module 101 could perform a step 311as depicted and described in connection with FIG. 3 in order tocalculate the second RES 119 value using the second key K 204. Theserver B 105 bb could (i) receive the second RES 119 from the module101, and (ii) compare the received second RES 119 with the recordedsecond RES 119 from the second authentication vector 117 b in order tocomplete the third authentication 310. The MNO 104 could then conduct astep 312 with additional messages to and from the module 101 in orderfor module 101 to access the IP network 111, including the globallyroutable public Internet.

CONCLUSION

Various exemplary embodiments have been described above. Those skilledin the art will understand, however, that changes and modifications maybe made to those examples without departing from the scope of theclaims.

What is claimed is:
 1. A computer system comprising: (a) one or moreprocessors; and (b) one or more non-transitory computer-readable mediaoperatively connected to the one or more processors and having storedthereon instructions that, when executed by the one or more processors,cause the computer system to perform a method of securely distributing aprofile from a subscription manager system to an embedded universalintegrated circuit card, the method comprising steps of: (1) recording,by the computer system in memory operatively connected to thesubscription manager system, a digital signature algorithm comprising anelliptic curve digital signature algorithm; (2) recording, by thecomputer system in the memory operatively connected to the subscriptionmanager system, a profile for the embedded universal integrated circuitcard comprising: (A) a key K; and (B) a network module identity, whereinthe profile has been encrypted using a first key that is a symmetrickey; (3) recording, by the computer system in the memory operativelyconnected to the subscription manager system, (A) a profile cipheringalgorithm to cipher the profile into a ciphered profile for the embeddeduniversal integrated circuit card, and (B) ciphering parameters to beused by the profile ciphering algorithm, wherein the cipheringparameters comprise an Advanced Encryption Standard ciphering algorithm;(4) authenticating, by the computer system using the subscriptionmanager system, the embedded universal integrated circuit card, byperforming steps of: (A) receiving, by the computer system using thesubscription manager system from the embedded universal integratedcircuit card, a first message comprising an eUICC identity associatedwith the embedded universal integrated circuit card; (B) receiving, bythe computer system using the subscription manager system from theembedded universal integrated circuit card, a second message comprisinga first digital signature generated by the embedded universal integratedcircuit card using the same digital signature algorithm as stored in thememory operatively connected to the subscription manager; and (C)authenticating, by the computer system using the subscription managersystem, the embedded universal integrated circuit card by confirming:(i) the eUICC identity which corresponds to the embedded universalintegrated circuit card; and (ii) the first digital signature which wassigned by the embedded universal integrated circuit card using thedigital signature algorithm; (5) authenticating, by the computer system,the subscription manager system with the embedded universal integratedcircuit by performing steps of: (A) generating, by the computer systemusing the subscription manager system, a third message including asecond digital signature, generated by the subscription manager usingthe digital signature algorithm; and (B) sending, by the computer systemfrom the subscription manager system to the embedded universalintegrated circuit card, the third message; (6) receiving, by thecomputer system using the subscription manager system from the embeddeduniversal integrated circuit card a fourth message comprising: (A) aneUICC public key corresponding to an eUICC private key stored at theembedded universal integrated circuit card; and (B) a third digitalsignature which was generated by the embedded universal integratedcircuit card using the same digital signature algorithm as stored in thememory operatively connected to the subscription manager; (7)confirming, by the computer system using the subscription managersystem, that the third digital signature was signed by the embeddeduniversal integrated circuit card using the digital signature algorithm;(8) generating, by the computer system using the subscription managersystem, an eUICC subscription manager public key and a correspondingeUICC subscription manager private key, using elliptic curvecryptography; (9) generating, by the computer system using thesubscription manager system, a second key that is a mutually derivedshared key using Elliptical Curve Diffie-Hellman based on at least: (A)the eUICC public key; and (B) the eUICC subscription manager privatekey; wherein the mutually derived shared key is configured to be derivedby the embedded universal integrated circuit card based on at least: (i)the eUICC private key associated with the eUICC public key; and (ii) theeUICC subscription manager public key associated with the eUICCsubscription manager private key; (10) generating, by the computersystem using the subscription manager system, a third key that is aprofile key using the second key that is the mutually derived sharedkey; (11) encrypting, by the computer system using the subscriptionmanager system, the profile using: (A) the profile ciphering algorithm;and (B) the third key that is the profile key; (12) authenticating, bythe computer system using the subscription manager system, a userassociated with the embedded universal integrated circuit card; (13)sending, by the computer system using the subscription manager system tothe embedded universal integrated circuit card, the symmetric key, afterthe user associated with the embedded universal integrated circuit cardis authenticated; and (14) sending, by the computer system from thesubscription manager system to the embedded universal integrated circuitcard, the encrypted profile.
 2. The computer system of claim 1, whereinthe third key that is the profile key is also generated using AmericanNational Standards Institute standard X-9.63.
 3. The computer system ofclaim 1, wherein the method further comprises a step of receiving, bythe computer system using the subscription manager system, the profilefor the embedded universal circuit card prior to the recording step (2).4. The computer system of claim 1, wherein the first message and secondmessage are received prior to sending the third message.
 5. The computersystem of claim 1, wherein the first message is received and thirdmessage is sent prior to receipt of the second message.
 6. The computersystem of claim 1, wherein the eUICC subscription manager public key hasa length of 283 bits.
 7. The computer system of claim 1, wherein theauthenticating step (12) occurs before the confirming step (7).
 8. Thecomputer system of claim 1, wherein the authenticating step (12) occursafter the confirming step (7).